Google PCA Practice Test 24 — 15 Questions

Question 1

Why did the VM resource fail while the disk succeeded?

Accepted Answer

The VM definition is missing a boot disk source reference.. Option B is correct because when you define a VM instance in Google Cloud, you must include a reference to a boot disk source. If the `source` field under `disks` is missing or empty, the API will reject the VM creation but may still succeed in creating the disk resource separately, since the disk creation does not depend on the VM. This explains why the disk succeeded while the VM failed.

Answer

The disk and VM must be in the same zone; us-central1-a is consistent.

Answer

The VM's machine type is not available in us-central1-a.

Answer

The VM's network is misspelled as 'global/networks/default' instead of 'global/networks/default' (correct).

Question 2

A startup wants to deploy a containerized application with minimal operational overhead. They expect variable traffic. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it is a fully managed serverless compute platform that automatically scales from zero based on traffic, charges only for resources used during request processing, and eliminates all infrastructure management. This aligns perfectly with the startup's requirement for minimal operational overhead and handling variable traffic patterns without provisioning or scaling concerns.

Answer

App Engine Flexible Environment

Answer

Compute Engine single VM

Answer

Google Kubernetes Engine (GKE)

Question 3

A startup is building a web application that experiences unpredictable traffic spikes. They want a scalable solution that minimizes costs. Which Google Cloud service should they use to run their containerized application?

Accepted Answer

Google Kubernetes Engine (GKE) with autoscaling. Google Kubernetes Engine (GKE) with autoscaling is the correct choice because it combines cluster autoscaling (which adjusts the number of nodes based on pod resource requests) with Horizontal Pod Autoscaling (which scales the number of pod replicas based on CPU/memory utilization or custom metrics). This dual-layer scaling handles unpredictable traffic spikes efficiently while minimizing costs by only provisioning resources when needed, and it is purpose-built for containerized applications.

Answer

App Engine Standard Environment

Answer

Cloud Run for Anthos

Answer

Compute Engine with managed instance groups

Question 4

A company wants to store backup data that is accessed rarely but must be available for retrieval within minutes. Which Cloud Storage class is appropriate?

Accepted Answer

Nearline. Nearline storage is designed for data accessed less than once a month but requires retrieval within minutes, making it ideal for backup data that needs quick availability. It offers lower cost than Standard storage while still supporting sub-minute retrieval times, aligning with the scenario's access and latency requirements.

Answer

Standard

Answer

Coldline

Answer

Archive

Question 5

An organization is implementing a Hub-and-Spoke network topology with multiple VPCs. Which Google Cloud product is designed for centralized connectivity and policy enforcement?

Accepted Answer

Shared VPC. Shared VPC (D) is the correct answer because it allows an organization to centrally manage connectivity and enforce network policies across multiple VPCs from a single host project. By designating a host project and attaching service projects, Shared VPC enables centralized control over firewall rules, routes, and IAM policies, which is essential for a hub-and-spoke topology where the host VPC acts as the hub and service VPCs as spokes.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Network Connectivity Center

Question 6

A developer needs to deploy a stateful application that requires persistent storage across pod restarts in Google Kubernetes Engine. Which resource should they use?

Accepted Answer

PersistentVolumeClaim. A PersistentVolumeClaim (PVC) is the correct resource because it allows a pod to request persistent storage that survives pod restarts. In GKE, a PVC binds to a PersistentVolume (PV), which can be backed by Compute Engine persistent disks, ensuring data remains available even if the pod is rescheduled or restarted.

Answer

ConfigMap

Answer

EmptyDir

Answer

Secret

Question 7

A developer needs to secure secrets (API keys, passwords) used in a Cloud Function. What is the recommended approach?

Accepted Answer

Use Secret Manager. Secret Manager is the recommended approach for securing sensitive data like API keys and passwords in Cloud Functions because it provides encrypted storage, fine-grained access control via IAM, and automatic rotation. Unlike environment variables, which are visible in the Cloud Console and logs, Secret Manager ensures secrets are never exposed in plaintext and are injected securely at runtime.

Answer

Store secrets in environment variables

Answer

Store in Cloud Storage and download at runtime

Answer

Hard-code in the function code

Question 8

A media streaming company uses Google Cloud CDN to deliver content. They notice that users in certain regions experience high latency despite CDN caching. The content is dynamic based on user location (e.g., local news). What should they do to improve performance?

Accepted Answer

Deploy Cloud Run services in multiple regions and use a global external HTTPS load balancer with backend services to route requests to the nearest region. Option A is correct because deploying Cloud Run services in multiple regions and using a global external HTTPS load balancer with backend services enables location-based routing via the load balancer's anycast IP and backend service configuration. The load balancer automatically routes user requests to the nearest Cloud Run backend that has capacity, reducing latency for dynamic, location-specific content that cannot be effectively cached by Cloud CDN.

Answer

Use Cloud Functions with a regional HTTP trigger and Cloud CDN to cache the responses

Answer

Use Cloud Armor to route traffic to the nearest point of presence

Answer

Configure Cloud CDN to use cache keys based on user location headers

Question 9

What are two best practices for designing a scalable Kubernetes architecture on GKE?

Accepted Answer

Enable horizontal pod autoscaling. Option C is correct because Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU/memory utilization or custom metrics, which is essential for handling variable workloads in a scalable Kubernetes architecture on GKE. HPA works by querying the Metrics Server and adjusting the `replicas` field in the Deployment or StatefulSet, ensuring efficient resource usage without manual intervention.

Answer

Use StatefulSets for stateless applications

Answer

Disable Cluster Autoscaler

Answer

Use a single zone cluster

Question 10

A startup is migrating a monolithic application to Google Cloud. They want to minimize operational overhead and auto-scale based on HTTP request load. Which compute solution should they choose?

Accepted Answer

Cloud Run. Cloud Run is the best choice because it is a fully managed serverless platform that automatically scales from zero based on HTTP request load, minimizing operational overhead. It abstracts away infrastructure management, supports containerized applications, and charges only for resources used during request processing, aligning perfectly with the requirement to auto-scale based on HTTP traffic.

Answer

Compute Engine managed instance groups with autoscaling

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Functions

Question 11

A global e-commerce platform uses Spanner for its transactional database. They observe that some transactions are aborted with 'ABORTED' status due to contention. The application retries immediately, but throughput degrades. What design change should they implement to reduce contention?

Accepted Answer

Redesign the schema to use a separate table for frequently updated rows and batch updates using a single transaction. Option A is correct because Spanner contention arises when multiple transactions try to update the same row concurrently, causing aborts. By redesigning the schema to use a separate table for frequently updated rows and batching updates into a single transaction, you reduce the number of overlapping locks on hot rows. This minimizes lock conflicts and aborts, improving throughput without changing Spanner's underlying TrueTime-based concurrency control.

Answer

Increase the number of nodes in the Spanner instance

Answer

Use client-side retry with exponential backoff and jitter

Answer

Change the transaction isolation level to READ UNCOMMITTED

Question 12

A company is migrating a monolithic application to Google Cloud and wants to minimize operational overhead for scaling. Which service should they use?

Accepted Answer

App Engine Standard. App Engine Standard is the correct choice because it provides a fully managed, autoscaling platform that abstracts away all infrastructure management, including server configuration, scaling, and load balancing. This minimizes operational overhead for scaling a monolithic application by automatically adjusting resources based on traffic without any manual intervention or cluster management.

Answer

Google Kubernetes Engine

Answer

Cloud Run

Answer

Compute Engine with managed instance groups

Question 13

A healthcare SaaS provider runs workloads in Google Cloud and needs to comply with HIPAA. They use Cloud SQL for PostgreSQL and want to encrypt data at rest with customer-managed encryption keys (CMEK). Which steps must they take?

Accepted Answer

Create a Cloud KMS key ring and key, then specify the key when creating the Cloud SQL instance. Option A is correct because Cloud SQL for PostgreSQL supports CMEK only at instance creation time. You must first create a Cloud KMS key ring and key in the same region as the instance, then specify that key when creating the Cloud SQL instance. This ensures that the data at rest is encrypted with a customer-managed key, meeting HIPAA compliance requirements for control over encryption keys.

Answer

Use customer-supplied encryption keys (CSEK) by uploading your own key material

Answer

Enable CMEK in the Cloud SQL instance's settings after creation

Answer

Create a Cloud HSM key and grant the Cloud SQL service account access to it

Question 14

A company stores sensitive data in Cloud Storage and wants to enforce encryption at rest using customer-managed keys. Which Google Cloud service should they use to manage the keys?

Accepted Answer

Cloud KMS. Cloud KMS (Key Management Service) is the correct choice because it is the native Google Cloud service for managing cryptographic keys, including customer-managed encryption keys (CMEK). It allows you to create, rotate, and control access to keys used to encrypt data at rest in Cloud Storage, and it integrates directly with Cloud Storage's CMEK feature. Cloud HSM is a hardware-backed key management option but is built on top of Cloud KMS, not a separate service for key management.

Answer

Cloud HSM

Answer

Secret Manager

Answer

IAM

Question 15

A company is migrating a legacy application to Google Cloud. The application has a stateful TCP-based protocol that requires client IP persistence. They plan to use a load balancer. Which load balancer type should they choose?

Accepted Answer

External Network Load Balancer (passthrough). The External Network Load Balancer (passthrough) is the correct choice because it preserves the original client IP address via direct server return (DSR) and does not terminate the TCP connection. This is essential for stateful TCP-based protocols that require client IP persistence, as the backend instances see the actual client IP and can maintain session state.

Answer

External HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP Proxy Load Balancer

Google PCA Practice Test 24 — 15 Questions

Exhibit

Google PCA Practice Test 24 — 15 Questions

Exhibit