Google PCA Practice Test 25 — 15 Questions

Question 1

A large enterprise is migrating their on-premises data center to Google Cloud. They have hundreds of VMs and need to minimize network latency between on-prem and cloud during migration. They have high bandwidth requirements. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, high-bandwidth, low-latency connection between on-premises data centers and Google Cloud, bypassing the public internet. This is ideal for large-scale migrations with hundreds of VMs where minimizing latency and ensuring consistent throughput is critical.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Peering with Google

Question 2

A company is using Cloud SQL for MySQL and wants to implement automated backups that are retained for 30 days. They also need point-in-time recovery. Which configuration should they use?

Accepted Answer

Enable automated backups with binary logging. Cloud SQL for MySQL requires automated backups to be enabled along with binary logging to support point-in-time recovery (PITR). Binary logs record all changes to the database, allowing you to restore to any specific timestamp within the backup retention period. Setting the retention to 30 days ensures backups are kept for the required duration, and binary logging enables the granular recovery needed for PITR.

Answer

Enable database replication

Answer

Use Cloud Storage versioning

Answer

Enable automated backups and set backup retention to 30

Question 3

A company has a Cloud Run service that processes images uploaded by users. The service reads the images from a Cloud Storage bucket and writes processed images to another bucket. The team recently updated the service to use a custom service account named 'image-processor-sa' with minimal permissions. After the update, the service fails with permission errors when trying to read from the source bucket. The team verified that the service account has the Storage Object Viewer role on the source bucket and Storage Object Creator role on the destination bucket. What should the architect do to resolve the issue?

Accepted Answer

Ensure the Cloud Run service uses the correct service account by redeploying with the --service-account flag set to 'image-processor-sa@project-id.iam.gserviceaccount.com'.. The error occurs because the Cloud Run service is not using the custom service account 'image-processor-sa' despite it being created and granted permissions. By default, Cloud Run uses the Compute Engine default service account unless explicitly overridden. Redeploying with the --service-account flag attaches the correct identity to the Cloud Run revision, allowing it to authenticate with Cloud Storage using the minimal permissions already assigned.

Answer

Grant the service account the Cloud Run Invoker role on the Cloud Run service.

Answer

Assign the Storage Admin role to the service account.

Answer

Enable the Cloud Storage API for the project.

Question 4

Which TWO of the following are benefits of using a VPC Service Controls perimeter?

Accepted Answer

Prevent data exfiltration from managed services like BigQuery and Cloud Storage. VPC Service Controls perimeters prevent data exfiltration by creating a security boundary around Google Cloud managed services (e.g., BigQuery, Cloud Storage). Within the perimeter, data can only be copied to other resources inside the same perimeter, blocking unauthorized transfers to external projects or the internet. This is achieved through context-aware access policies that enforce data access based on the client's network identity and project membership, not by inspecting packet contents.

Answer

Act as a network firewall for Compute Engine instances

Answer

Provide encryption of data in transit between on-premises and Google Cloud

Answer

Replace Identity and Access Management (IAM) for service access control

Question 5

A team is designing a multi-tier web application on Compute Engine. They need to ensure that only the web tier can access the application tier over a specific port. They plan to use VPC firewall rules. Which approach minimizes the attack surface?

Accepted Answer

Allow ingress from the web tier's instances' service accounts to the application tier's instances. Option A is correct because it uses service account-based firewall rules, which allow you to specify the source as the service account attached to the web tier's instances rather than their IP addresses or subnets. This ensures that only instances with that specific service account (i.e., the web tier) can reach the application tier on the designated port, regardless of their IP or subnet. By scoping access to a specific identity, you minimize the attack surface because no other instances, even those in the same subnet, can reach the application tier unless they also use that service account.

Answer

Allow ingress from any source to the application tier on the port

Answer

Allow ingress from the web tier's subnet to the application tier's instances on the port

Answer

Allow egress from the web tier to the application tier

Question 6

A company is designing a disaster recovery plan for their Cloud SQL for PostgreSQL instance. They want to ensure that the database can be recovered in another region within minutes with minimal data loss. Which three actions should they take? (Choose three.)

Accepted Answer

Enable point-in-time recovery. Enabling point-in-time recovery (PITR) for Cloud SQL for PostgreSQL is correct because it allows you to restore the database to any specific point in time within the backup retention period, minimizing data loss to within seconds. PITR relies on write-ahead logs (WAL) archived continuously, which are essential for recovering to a precise timestamp in a disaster scenario. This directly supports the requirement of minimal data loss during cross-region recovery.

Answer

Configure a failover replica in a different zone within the same region

Answer

Enable automated backups with a retention period of 30 days

Question 7

A company is running a multi-region application on Google Kubernetes Engine with workloads in us-central1 and europe-west1. They want to route traffic to the closest region based on user location. Which three components should they configure? (Choose three.)

Accepted Answer

Cloud DNS with geo-routing policy. Option B is correct because Cloud DNS geo-routing policy directs DNS queries to the closest healthy backend based on the user's geographic location, enabling traffic to be routed to the nearest GKE region (us-central1 or europe-west1). This is essential for minimizing latency and optimizing user experience in a multi-region setup.

Answer

Cloud Armor security policy

Answer

Regional internal load balancer

Question 8

A company uses preemptible VMs for batch processing. They notice that during peak hours, many instances are terminated before finishing their tasks. The operations team observes the output shown in the exhibit. Which action would best improve job completion rates without significantly increasing costs?

Accepted Answer

Use instance groups with a mix of preemptible and regular VMs. Option C is correct because using a mixed instance group with both preemptible and regular VMs allows the batch processing job to continue on regular VMs when preemptible VMs are terminated during peak hours. This balances cost and reliability: preemptible VMs handle most of the workload at low cost, while regular VMs act as a fallback to ensure job completion without the full expense of switching entirely to regular VMs.

Answer

Increase the number of instances to compensate for terminations

Answer

Use sole-tenant nodes for these instances

Answer

Use committed use discounts for 1 year

Answer

Switch to regular VMs for critical jobs

Question 9

A multinational corporation has deployed a web application across multiple Google Cloud regions using an external HTTPS load balancer with backend services in each region. They recently added a new region (asia-southeast1) and updated the load balancer configuration. After the update, some users in that region report high latency and occasional connection timeouts when accessing the application. The load balancer health checks show all backends as healthy. The network team confirms that the backend instances in asia-southeast1 are correctly configured and can be accessed directly via their external IPs. What should the architects investigate next?

Accepted Answer

Review the Cloud Armor security policy rules that might be blocking traffic from that region. Option D is correct because Cloud Armor security policies can block traffic based on geographic location. If the new region (asia-southeast1) was added but the Cloud Armor policy was not updated to allow traffic from that region, requests from users in asia-southeast1 could be denied or rate-limited, causing high latency and timeouts even though health checks (which originate from Google's health check ranges, not user IPs) show backends as healthy. The direct access via external IPs works because it bypasses the load balancer and its associated Cloud Armor policy.

Answer

Check the Cloud CDN cache settings for the new region

Answer

Verify that the backend service in asia-southeast1 has the correct timeout settings for the load balancer

Answer

Ensure that the firewall rules allow traffic from the load balancer's health check ranges to the instances

Question 10

A developer needs to pass a startup script to a Compute Engine instance during creation. Which method should be used to ensure the script runs on first boot?

Accepted Answer

Use gcloud compute instances create with --metadata=startup-script=.... The `--metadata=startup-script=...` flag on `gcloud compute instances create` passes the script as instance metadata. Compute Engine automatically executes the value of the `startup-script` metadata key on every boot, including the first boot. This is the standard, documented method for providing a startup script at instance creation time.

Answer

Create a custom image with the script baked in.

Answer

Use gcloud compute instances add-metadata after creating the instance.

Answer

Use gcloud compute instances create with --startup-script flag.

Question 11

A company has Compute Engine instances in us-east1-a and us-east1-b zones. They want to allow communication between these instances with minimal latency and no additional cost. What is the best networking approach?

Accepted Answer

Use a single VPC network that includes both zones.. A single VPC network spans all regions and zones, allowing instances in different zones (us-east1-a and us-east1-b) to communicate using internal IP addresses with low latency and no additional cost. This is because VPC networks provide flat, global networking by default, and traffic between zones within the same VPC uses Google's internal backbone without incurring egress charges.

Answer

Configure VPC Network Peering between two separate VPC networks.

Answer

Create a new subnet in each zone and use Cloud NAT.

Answer

Set up a Cloud VPN between the zones.

Question 12

A company uses Shared VPC. A project admin in a service project tries to create a subnet in the shared VPC network but receives a permission denied error. What is the most likely cause?

Accepted Answer

The service project admin lacks the compute.subnetworks.create permission on the host project.. In a Shared VPC architecture, subnet creation is a privileged operation that can only be performed by a user with the compute.subnetworks.create permission on the host project. The service project admin, by default, does not have this permission in the host project, which is why the permission denied error occurs. Granting this permission to the service project admin at the host project level would resolve the issue.

Answer

Only the Shared VPC host project admin can create subnets.

Answer

The Shared VPC is not enabled for the service project.

Answer

Subnets must be created in the service project, not the host project.

Question 13

A Cloud Router BGP session is flapping. The logs show 'Interface flapping due to changes in the underlying network'. What is the most likely cause?

Accepted Answer

MTU mismatch across the network path.. The log message 'Interface flapping due to changes in the underlying network' indicates that the BGP session is unstable because the physical or logical interface is going up and down. An MTU mismatch across the network path can cause packet fragmentation issues, leading to intermittent connectivity and interface flaps as the router detects and recovers from the problem. This is the most likely cause because it directly affects the stability of the underlying network path.

Answer

BGP MD5 authentication failure.

Answer

Incorrect local AS number in Cloud Router configuration.

Answer

BGP timer misconfiguration between peers.

Question 14

Which THREE factors should be considered when selecting a machine series for a Compute Engine instance running a memory-intensive batch job?

Accepted Answer

Network throughput.. Network throughput (A) is a critical factor for a memory-intensive batch job because such jobs often involve reading or writing large datasets from persistent storage or other sources over the network. The instance series must provide sufficient network bandwidth to avoid I/O bottlenecks that could extend job completion time, even if the compute and memory resources are adequate.

Answer

Sustained use discount.

Answer

GPU availability.

Question 15

Refer to the exhibit. A user reports that the instance 'batch-vm' is unavailable. Based on the output, what is the most likely cause of the unavailability?

Accepted Answer

The preemptible VM was terminated by Google due to its preemptible nature.. The exhibit shows the instance 'batch-vm' with a status of 'TERMINATED' and the 'preemptible' flag set to 'true'. Preemptible VMs in Google Cloud have a maximum runtime of 24 hours and can be terminated at any time by Google Compute Engine due to resource constraints. The termination reason is typically 'preemption', which matches the scenario of a user reporting unavailability without manual intervention.

Answer

The VM was stopped manually by a user.

Answer

The VM lost its external IP address.

Answer

The VM crashed due to an out-of-memory error.