Google PCA Practice Test 25 — 15 Questions

Question 1

A developer needs to secure secrets (API keys, passwords) used in a Cloud Function. What is the recommended approach?

Accepted Answer

Use Secret Manager. Secret Manager is the recommended approach for securing sensitive data like API keys and passwords in Cloud Functions because it provides encrypted storage, fine-grained access control via IAM, and automatic rotation. Unlike environment variables, which are visible in the Cloud Console and logs, Secret Manager ensures secrets are never exposed in plaintext and are injected securely at runtime.

Answer

Store secrets in environment variables

Answer

Store in Cloud Storage and download at runtime

Answer

Hard-code in the function code

Question 2

Your organization requires all container images deployed to GKE to be signed by an approved authority. Which service enforces that only signed images are allowed to run?

Accepted Answer

Binary Authorization. Binary Authorization is a deploy-time security control on GKE and Cloud Run that only permits container images that satisfy a defined policy — typically requiring attestations from trusted authorities (e.g., a vulnerability scanner or a signing step in the CI pipeline). It integrates with Container Analysis, which stores the attestations, but Binary Authorization is the component that actually blocks unsigned or unattested images from being admitted to the cluster.

Answer

Cloud Asset Inventory

Answer

Artifact Registry

Answer

Container Analysis

Question 3

A company wants to monitor the performance of their microservices deployed on Cloud Run. They need to capture request latencies and error rates, and also trace requests across services. Which TWO services should they use?

Accepted Answer

Cloud Trace. Cloud Trace (A) is correct because it is Google Cloud's distributed tracing service, which collects and correlates latency data across microservices so a single request can be followed from one Cloud Run service to the next. Cloud Monitoring (E) is correct because it ingests Cloud Run request metrics such as request count, latency, and error rates, and lets you build dashboards and alerting policies on them. Together they satisfy the stated requirements of capturing request latencies and error rates while tracing requests across services. Error Reporting (B) only aggregates and groups application exceptions, Cloud Profiler (C) analyzes CPU and memory usage of running code, and Cloud Logging (D) stores log entries; none of these provide distributed tracing or the request-level latency and error-rate metrics required here.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Logging

Question 4

Your team uses Cloud SQL for PostgreSQL for an e-commerce application. You want to perform point-in-time recovery (PITR) to recover from a logical error that occurred 10 minutes ago. Which prerequisites are required?

Accepted Answer

Automated backups must be enabled, and write-ahead logging (WAL) must be active. For Cloud SQL for PostgreSQL, point-in-time recovery (PITR) requires that automated backups are enabled and that write-ahead logging (WAL) is active. WAL archiving captures all changes, allowing recovery to any point within the retention period. Automated backups provide the base backup from which WAL is replayed.

Answer

Automated backups must be enabled, and the instance must be using the InnoDB storage engine

Answer

Automated backups and binary logging must be enabled

Answer

Point-in-time recovery is not supported for Cloud SQL PostgreSQL

Question 5

An engineering team is deploying a microservices application on Google Cloud. They want to use a service mesh for observability, traffic management, and security. They are considering Anthos Service Mesh (ASM). Which THREE components are part of ASM? (Choose THREE.)

Accepted Answer

Envoy sidecar proxies. Anthos Service Mesh is Google's managed Istio-based service mesh, so its data plane consists of Envoy sidecar proxies (option B) injected alongside workloads to intercept and manage all service-to-service traffic. The Istio control plane (option E) is the core of ASM, providing the configuration, certificate authority, and policy enforcement that drive the mesh's traffic management and security features. ASM integrates with Cloud Monitoring and Cloud Logging (option C) to deliver the observability the team wants, exporting mesh telemetry, metrics, and logs to Google Cloud's operations suite. Cloud Endpoints (option A) is a separate API management product, not a component of ASM, and GKE (option D) is the underlying Kubernetes platform that can host ASM but is not itself a service mesh component.

Answer

Cloud Endpoints

Answer

Google Kubernetes Engine (GKE)

Question 6

A company is migrating an on-premises PostgreSQL database to Cloud SQL with minimal downtime. The database is 1 TB and the network link has 500 Mbps bandwidth. Which migration approach is most appropriate?

Accepted Answer

Use Database Migration Service to perform continuous replication and then promote Cloud SQL.. Database Migration Service (DMS) supports continuous replication from on-premises PostgreSQL to Cloud SQL using native PostgreSQL logical replication (pglogical or native publication/slot). This allows near-zero downtime by keeping the target in sync until promotion, which is ideal for a 1 TB database over a 500 Mbps link where a full dump/restore would take hours.

Answer

Set up a Compute Engine instance with PostgreSQL replication and switch over.

Answer

Use BigQuery Data Transfer Service to replicate data.

Answer

Export the database as a SQL dump, transfer it to Cloud Storage, and import into Cloud SQL.

Question 7

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

Accepted Answer

Cloud Run (fully managed).. Cloud Run (fully managed) is the right choice because it runs containerized applications on a fully managed serverless platform that automatically scales instances up and down (including to zero) based on traffic, and it bills only for the CPU, memory, and request resources actually consumed. This matches the startup's needs: containers, automatic scaling, pay-per-use pricing, and minimal operational overhead since Google manages the underlying infrastructure. App Engine Standard with a custom runtime is more restrictive and less container-native, while GKE with a multi-node pool and Compute Engine with a managed instance group both require the team to manage clusters, nodes, or instances and typically incur costs for provisioned capacity even when idle, which does not fit a low-ops, usage-based model.

Answer

App Engine Standard Environment with a custom runtime.

Answer

Google Kubernetes Engine (GKE) with a multi-node pool.

Answer

Compute Engine with a managed instance group.

Question 8

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Accepted Answer

The service account lacks IAM permissions to read from Cloud Storage. The correct answer is D: the service account lacks IAM permissions to read from Cloud Storage. Even when a service account is properly attached to a Compute Engine instance, the instance's applications can only access Cloud Storage buckets if that service account has been granted the appropriate IAM roles (for example, roles/storage.objectViewer) on the bucket or project. The failure to read from the bucket is therefore most likely an authorization issue at the IAM layer rather than a configuration problem with the instance itself. Option A is not the cause because the scenario states the instance uses its service account, and even a missing attachment would be a different setup issue. Option B is incorrect because firewall tags like http-server and https-server govern inbound HTTP/HTTPS traffic, not outbound access to the Cloud Storage API. Option C is incorrect because the boot disk type (SSD vs. standard) has no bearing on Cloud Storage access.

Answer

The service account is not attached to the instance

Answer

The tags http-server and https-server block outbound traffic

Answer

The boot disk type is SSD, which is not compatible with Cloud Storage

Question 9

An organization wants to enforce that all container images deployed to their Google Kubernetes Engine (GKE) clusters are signed and have passed a vulnerability scan. Which GCP service should they use to enforce this policy?

Accepted Answer

Binary Authorization. Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed to GKE or Cloud Run. It works by requiring attestations (cryptographically signed proofs) that images have been built by a trusted builder and passed required checks such as vulnerability scanning. If an image lacks the required attestation, the admission controller rejects the deployment.

Answer

Cloud Build

Answer

Artifact Registry

Answer

IAM

Question 10

Your company uses Cloud Spanner in a multi-region configuration to achieve 99.999% availability. You need to understand the impact of a regional failure on read and write availability. Which statement is correct?

Accepted Answer

Writes are unavailable if the region containing the leader replica fails, but reads remain available. Cloud Spanner multi-region configurations use a leader replica in one region and read-only replicas in others. Writes must go through the leader (Paxos quorum), so if the region hosting the leader fails, writes are unavailable until a new leader is elected — typically within seconds to minutes depending on the config. Reads, however, can be served from any healthy replica (strong or stale reads), so read availability is preserved as long as at least one replica region survives.

Answer

Both reads and writes are fully available as long as at least one region remains healthy

Answer

Reads and writes remain fully available because Cloud Spanner uses synchronous replication across all regions

Answer

Writes are always available, but reads may be unavailable if the region with the closest replica fails

Question 11

You need to create a Cloud Logging sink that exports logs to a BigQuery dataset for long-term analysis. Which destination type should you specify?

Accepted Answer

BigQuery. Cloud Logging sinks support three destination types: Cloud Storage, BigQuery, and Pub/Sub (plus custom destinations via Pub/Sub or Logging API). BigQuery is the correct choice here because the requirement is long-term analysis of log data, and BigQuery provides a fully managed, serverless data warehouse with SQL querying, partitioning, and clustering capabilities ideal for analytical workloads on exported logs.

Answer

Cloud Storage

Answer

Pub/Sub

Answer

Custom HTTP endpoint

Question 12

Which THREE of the following are recommended practices when designing a highly available architecture on Google Cloud using multiple regions?

Accepted Answer

Use a global external HTTP(S) load balancer with backend services in multiple regions. Option B is correct because a global external HTTP(S) load balancer uses a single anycast IP and automatically routes users to the closest healthy backend service across multiple regions, providing global failover and low-latency access. Option C is correct because Cloud Spanner offers a multi-region configuration with synchronous replication and strong consistency, and cross-region replication for databases ensures data survives a regional outage. Option D is correct because health checks detect unhealthy endpoints and Cloud DNS weighted routing (or failover routing policies) can automatically direct traffic away from a failed region. Option A is not recommended because a single regional managed instance group confines instances to one region, so a regional outage takes down the whole workload. Option E is not recommended because a single Cloud VPN tunnel is a single point of failure; highly available designs require redundant tunnels or Cloud Interconnect with multiple paths.

Answer

Deploy Compute Engine instances in a single regional managed instance group

Answer

Use a single Cloud VPN tunnel for connectivity between regions

Question 13

A company wants to use Binary Authorization to enforce that only images signed by their internal CI/CD pipeline can be deployed to their GKE clusters. They have set up Cloud Build to sign images. Which THREE steps are required to configure this? (Choose 3)

Accepted Answer

Create an attestation for each container image using Cloud Build. Option C is correct because Binary Authorization requires an attestor resource, which defines the cryptographic key pair (via Cloud KMS) and is used to verify attestations; without creating an attestor, no attestation can be validated. Option A is correct because the CI/CD pipeline (Cloud Build) must create a signed attestation for each container image after building it, proving the image was produced by the trusted pipeline. Option B is correct because a Binary Authorization policy must be configured to require attestations from that attestor for the GKE cluster, otherwise the cluster will not enforce the signature requirement. Option D is not required: signing keys can be managed in Cloud KMS, and Cloud HSM is only an optional key protection level, not a mandatory step. Option E is not required: roles/container.deployer is unrelated to Binary Authorization enforcement and does not configure attestation verification.

Answer

Store the signing keys in Cloud HSM

Answer

Grant the GKE service account the roles/container.deployer role

Question 14

A company has a Cloud SQL for PostgreSQL instance in a single zone. To achieve high availability, they want to ensure automatic failover with zero data loss and minimal downtime. Which configuration should they use?

Accepted Answer

Configure a Cloud SQL regional instance with a failover replica in a different zone. A Cloud SQL regional instance provisions a standby replica in a different zone within the same region and performs automatic failover with synchronous replication, ensuring zero data loss (RPO=0) and minimal downtime. This is the standard HA configuration for Cloud SQL for PostgreSQL.

Answer

Deploy a read replica in the same zone and enable automatic failover

Answer

Enable automatic backups and point-in-time recovery

Answer

Add a cross-region read replica and configure failover manually

Question 15

An e-commerce company uses Cloud SQL for MySQL to handle user sessions. During Black Friday sales, the database experiences high read latency and connection timeouts. The traffic pattern shows 95% read operations and 5% write operations. They need to improve read performance without significant architectural changes. Which action should they take?

Accepted Answer

Add Cloud SQL read replicas and configure the application to use them for read operations.. Adding Cloud SQL read replicas and routing read traffic to them offloads the primary instance, which is the standard, low-disruption way to scale read-heavy workloads. With 95% reads, this directly addresses the bottleneck without architectural changes. Cloud SQL Proxy, Spanner migration, and storage/machine-type increases do not solve read contention as directly or with as little disruption.

Answer

Enable Cloud SQL Proxy to reduce connection overhead.

Answer

Migrate from Cloud SQL to Cloud Spanner for better scalability.

Answer

Enable automatic storage increases and increase the machine type of the primary instance.