Google PCA Practice Test 2 — 25 Questions

Question 1

Which TWO of the following are benefits of using a VPC Service Controls perimeter?

Accepted Answer

Prevent data exfiltration from managed services like BigQuery and Cloud Storage. VPC Service Controls perimeters are designed to mitigate data exfiltration risks for managed services such as BigQuery, Cloud Storage, and other Google Cloud APIs, so option A is correct because the perimeter restricts data movement across its boundary even when credentials are valid. Option E is also correct because a perimeter defines an authorized boundary (based on VPC networks, projects, and access levels) from which managed services can be reached, effectively allowing access only from authorized VPC networks. Option B is wrong because VPC Service Controls is not a network firewall for Compute Engine instances; that role belongs to VPC firewall rules and hierarchical firewall policies. Option C is wrong because encryption in transit between on-premises and Google Cloud is handled by mechanisms such as Cloud VPN, Cloud Interconnect with MACsec, or application-layer TLS, not by VPC Service Controls. Option D is wrong because VPC Service Controls complements rather than replaces IAM; IAM still governs identities and permissions, while the perimeter adds an independent context-aware boundary.

Answer

Act as a network firewall for Compute Engine instances

Answer

Provide encryption of data in transit between on-premises and Google Cloud

Answer

Replace Identity and Access Management (IAM) for service access control

Question 2

An organization requires that only container images signed by a trusted authority can be deployed on Google Kubernetes Engine (GKE). Which Google Cloud service should they implement?

Accepted Answer

Binary Authorization. Binary Authorization is a Google Cloud service that enforces deploy-time policies on GKE, allowing only container images signed by trusted authorities to be deployed. It integrates with Container Analysis and attestations to verify signatures before admission.

Answer

Artifact Registry

Answer

Secret Manager

Answer

Cloud Deploy

Question 3

Your organization has a policy that all Compute Engine instances must have specific labels (env, team, cost-center) applied. You want to enforce this automatically when instances are created. What should you do?

Accepted Answer

Use the Organization Policy service with a custom constraint to require labels on Compute Engine instances.. Organization Policy Service with a custom constraint allows you to enforce that all Compute Engine instances must have specific labels (env, team, cost-center) at creation time. This is a preventive control that blocks creation of non-compliant instances, unlike reactive or permission-based approaches. Custom constraints use the `compute.googleapis.com/instance` resource type and can require label keys or values using CEL (Common Expression Language) syntax.

Answer

Enable Cloud Audit Logs and set up a metric-based alert to detect instances without labels.

Answer

Create a Cloud Function that listens for instance creation events and adds labels automatically.

Answer

Assign a custom IAM role that includes permission to label instances, and remove the default compute.instances.create permission.

Question 4

A financial services company is migrating a monolithic Java application to Google Kubernetes Engine (GKE) for improved scalability and reliability. The application serves real-time trading data and has strict latency requirements. Post-migration, the team observes frequent pod restarts due to OutOfMemory (OOM) errors, increased latency during peak trading hours, and occasional database connection timeouts. The current setup uses a single GKE cluster with a node pool of n1-standard-4 machines, a stateless application deployed as a Deployment with resource requests and limits set to 512 Mi memory and 1 CPU. The database is a Cloud SQL PostgreSQL instance with 2 vCPUs and 7.5 GB memory, and applications connect using a hardcoded connection string. The team wants to ensure reliable operation under load and during node maintenance events. Which course of action best addresses the reliability issues?

Accepted Answer

Adjust resource requests to 1 Gi memory and 2 CPU, set limits to 2 Gi and 4 CPU, create an HPA based on a custom metric (e.g., requests per second), enable cluster autoscaler, implement Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max connection pool size, and configure PDB with maxUnavailable 1.. Best addresses all reliability issues. Adjusting resource requests to 1 Gi memory and 2 CPU ensures proper scheduling, while limits of 2 Gi and 4 CPU prevent OOM errors. The HPA based on custom metrics (e.g., requests per second) scales pods proactively during peak trading hours. Cluster autoscaler handles node capacity, and Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max pool size prevents database connection timeouts. Finally, a PDB with maxUnavailable 1 ensures availability during node maintenance. Option B misses resource tuning, autoscaling, and connection pooling. Option C unnecessarily moves the database to GKE, increasing complexity and losing managed DB benefits. Option D lacks custom metric HPA, cluster autoscaler, and PDB, leaving gaps in scalability and maintenance handling.

Answer

Enable GKE node auto-upgrade, configure Pod Disruption Budgets (PDB) with minAvailable 1, and set readiness probes to check application health.

Answer

Migrate the database to a StatefulSet in GKE with persistent volumes, increase node count to 10, and enable cluster autoscaler.

Answer

Increase memory limits to 2 Gi and CPU to 2, add Horizontal Pod Autoscaler (HPA) based on CPU utilization, and implement connection pooling using Cloud SQL Auth Proxy.

Question 5

An organization needs to audit all changes to network firewall rules in a GCP project. Which service should be used to capture these changes?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify the configuration or metadata of resources, including changes to firewall rules. When a firewall rule is created, updated, or deleted, an audit log entry is automatically generated with details such as the user, timestamp, and the change made. This makes Cloud Audit Logs the correct service for auditing changes to network firewall rules in a GCP project.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Question 6

An organization deploys a web application on Compute Engine behind a global HTTPS load balancer. They want to reduce latency for users worldwide and minimize load on backend instances. Which GCP service should they use?

Accepted Answer

Cloud CDN. Cloud CDN uses Google's global edge caches to serve content closer to users, reducing latency and backend load. Cloud Armor provides security, Cloud NAT is for outbound connectivity, and VPC peering is for network connectivity, not caching.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

VPC Network Peering

Question 7

Which THREE steps can reduce processing costs in a Dataflow streaming pipeline? (Choose three.)

Accepted Answer

Use side inputs instead of a cross join.. Option A is correct because replacing a cross join with side inputs avoids the expensive fan-out of every element being paired with every element of the other collection, which drastically reduces the number of elements processed and shuffled in the streaming pipeline. Option B is correct because running non-critical data through a batch pipeline lets Dataflow use cheaper batch pricing and more efficient batch-optimized execution rather than paying for continuously running streaming workers. Option C is correct because GroupByKey in streaming mode forces a shuffle and holds state for each key until the window fires, so minimizing it (for example by using Combine or pre-aggregation) lowers shuffle volume, state storage, and processing cost. Option D is not correct because a custom runner does not reduce Dataflow processing costs and is not a cost-optimization step. Option E is not correct because increasing the number of workers raises the amount of compute used and therefore increases, rather than reduces, processing costs.

Answer

Use a custom runner.

Answer

Increase the number of workers.

Question 8

A financial services company requires a globally distributed relational database with strong consistency and horizontal scalability to serve a multi-region banking application. Write conflicts are rare. Which database should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is Google's globally distributed, horizontally scalable, strongly consistent relational database. It uses TrueTime and Paxos to provide external consistency across regions, making it the only option that meets all three requirements: global distribution, strong consistency, and horizontal scalability for a relational workload.

Answer

Firestore in Native mode

Answer

Cloud SQL with cross-region replication

Answer

Cloud Bigtable

Question 9

A company is planning a phased migration of their on-premises database to Cloud SQL. They want to minimize downtime and ensure data consistency. Which approach should they use?

Accepted Answer

Use Database Migration Service (DMS). Database Migration Service (DMS) supports continuous replication with minimal downtime. Export and import involves downtime. Lift-and-shift is not a GCP service. VM migration is for servers, not databases.

Answer

Lift and shift the database server to Compute Engine

Answer

Export the database to a SQL dump file and import into Cloud SQL

Answer

Use VM migration to move the database server

Question 10

You are the lead cloud architect for a startup that runs a web application on Google Kubernetes Engine (GKE) with a standard (zonal) cluster. The application is deployed with 3 replicas of a stateless frontend service. During a recent incident, a zone outage caused all GKE nodes to become unavailable, leading to application downtime of 45 minutes. You need to redesign the cluster to tolerate a single zone failure with no more than 5 minutes of downtime. Your budget allows for at most a 20% increase in compute costs. Which approach should you take?

Accepted Answer

Migrate the cluster to a regional GKE cluster with nodes in 3 zones and distribute replicas across zones. D is correct because a regional GKE cluster distributes nodes across three zones, ensuring that if one zone fails, the remaining two zones continue serving traffic. By spreading the 3 replicas across zones (e.g., one per zone), the application tolerates a single zone outage with near-zero downtime, and the 20% cost increase covers the additional node pool overhead without exceeding the budget.

Answer

Increase the number of replicas from 3 to 9 and keep the zonal cluster

Answer

Change the frontend deployment to use regional persistent disks

Answer

Deploy second GKE cluster in another region and use global load balancer for failover

Question 11

An organization uses Cloud Functions (2nd gen) for event-driven processing. They notice that some functions fail with 'memory limit exceeded' errors during peak load. The function processes messages from Pub/Sub and writes to Firestore. What should they do to improve reliability without sacrificing throughput?

Accepted Answer

Increase the memory allocated to the Cloud Function.. The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.

Answer

Increase the maximum number of concurrent function instances.

Answer

Enable Pub/Sub batching to reduce the number of function invocations.

Answer

Split the function into multiple smaller functions, each handling a subset of the data.

Question 12

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

Accepted Answer

A firewall rule with the name 'my-firewall' already exists in the project.. The error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Answer

The user lacks IAM permissions to create firewall rules.

Answer

The network reference in the firewall rule is incorrect.

Answer

The deployment does not include a 'delete' policy for existing resources.

Question 13

A company deploys a microservices application on Google Kubernetes Engine (GKE). Pods in one deployment are frequently OOMKilled. The team sets memory requests and limits, but pods still crash. What is the most likely remaining cause?

Accepted Answer

The application has a memory leak that eventually exceeds the limit.. OOMKilled errors occur when a container exceeds its memory limit. Setting memory requests and limits prevents unbounded usage, but if the application has a memory leak, it will continue to consume memory until it hits the configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the pod. The fact that pods still crash after setting limits indicates the application itself is the root cause, not resource configuration.

Answer

CPU requests are too low, causing throttling and eventual crash.

Answer

The node pool is too small, causing memory pressure on the node.

Answer

Memory limits are set higher than the node's allocatable memory.

Question 14

A company is using Cloud NAT to allow private instances to access the internet. They notice that outbound connections are failing intermittently. What is the most likely cause?

Accepted Answer

The number of concurrent connections exceeds the Cloud NAT source port capacity for the assigned NAT IPs.. Cloud NAT uses source network address translation (SNAT) to map private instance IPs to a single public IP address. Each NAT IP has a limited pool of source ports (typically 64,512 per IP for TCP/UDP). When concurrent connections exceed this capacity, new outbound connections are dropped, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures.

Answer

The private instances are using the wrong DNS server.

Answer

The VPC firewall rules are blocking egress traffic.

Answer

Cloud NAT does not support TCP connections.

Question 15

A team is designing a disaster recovery plan for a critical application. They need to ensure RPO of less than 1 hour and RTO of less than 4 hours. The application runs on Compute Engine with persistent disks and uses Cloud SQL for MySQL. Which THREE actions should they take? (Choose 3.)

Accepted Answer

Store application configuration and scripts in a multi-regional Cloud Storage bucket. Option C is correct because storing application configuration and scripts in a multi-regional Cloud Storage bucket ensures they remain available even if one region fails, supporting recovery within the 4-hour RTO without manual rebuild delays. Option D is correct because Cloud SQL cross-region replication continuously replicates the MySQL database to a replica in another region, enabling a low RPO (well under 1 hour) and a fast promotion/failover path to meet the 4-hour RTO. Option E is correct because regular persistent disk snapshots replicated to another region via Cloud Storage provide a restorable copy of Compute Engine disk data in the DR region, which is necessary to rebuild instances within the RTO and keep data loss under the RPO. Option A is not appropriate because Transfer Appliance is an offline, batch data-transfer appliance with weekly cadence, which cannot meet an RPO under 1 hour or an RTO under 4 hours. Option B is not sufficient because a regional managed instance group only provides automatic failover across zones within a single region, not cross-region disaster recovery, so a region-wide outage would still exceed the required RTO/RPO.

Answer

Deploy a Transfer Appliance to copy data to another region weekly

Answer

Use a regional managed instance group and rely on Google's automatic failover

Question 16

A company is migrating a stateful application to Google Cloud. The application requires persistent disks with low latency and high IOPS for database workloads. They plan to use Compute Engine instances with SSD persistent disks. However, the database performance is lower than expected. Which action should the company take to improve disk performance?

Accepted Answer

Use local SSDs with RAID 0 configuration for the database data.. Local SSDs provide the highest IOPS and lowest latency of any disk option on Compute Engine, and striping them with RAID 0 aggregates their performance. This directly addresses the need for high IOPS and low latency for database workloads, unlike persistent disks which have performance ceilings tied to disk size and instance limits.

Answer

Change the persistent disk type to standard persistent disk.

Answer

Increase the disk size to increase baseline IOPS.

Answer

Enable disk encryption to improve I/O throughput.

Question 17

A company runs a microservices-based application on Google Kubernetes Engine (GKE) with a Regional cluster. They want to improve reliability by implementing best practices for pod scheduling and resilience. Which TWO actions should they take? (Choose two.)

Accepted Answer

Define a PodDisruptionBudget for each deployment to limit the number of concurrent disruptions. A PodDisruptionBudget (PDB) limits the number of Pods of a replicated application that can be down simultaneously from voluntary disruptions, such as node maintenance or cluster upgrades. This ensures that a minimum number of replicas remain available, improving application reliability during planned events.

Answer

Set terminationGracePeriodSeconds to 0 for faster pod termination during scale-down

Answer

Enable cluster autoscaler to automatically add nodes when pods are pending

Answer

Set resource requests equal to limits to ensure guaranteed QoS class

Question 18

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Accepted Answer

Deployment with pod anti-affinity rules spread across zones. The correct option is B: a Deployment with pod anti-affinity rules spread across zones. Deployments are the standard GKE workload for stateless microservices, providing declarative rolling updates (via RollingUpdate strategy with maxSurge/maxUnavailable) and integration with the Horizontal Pod Autoscaler for automatic scaling, while pod anti-affinity (or topologySpreadConstraints) spreads replicas across multiple zones for high availability. StatefulSet (A) is designed for stateful workloads needing stable network identities and per-pod PersistentVolumes, not for stateless services requiring rolling updates and autoscaling. Job (C) runs finite batch tasks to completion rather than long-running services, and DaemonSet (D) schedules one pod per node for node-level agents, not scalable service replicas.

Answer

StatefulSet with volumeClaimTemplates for persistent storage

Answer

Job for batch processing

Answer

DaemonSet to ensure one pod per node

Question 19

Which IAM role should be granted to a user who needs to view but not modify resources in a project?

Accepted Answer

roles/viewer. The roles/viewer role grants read-only access to all resources within a project, allowing the user to view but not modify them. This aligns with the principle of least privilege for a user who only needs to inspect resources. It includes permissions to list and get resources but not to create, update, or delete.

Answer

roles/editor

Answer

roles/owner

Answer

roles/browser

Question 20

Which THREE actions can help reduce costs for a BigQuery workload that runs frequent, ad-hoc analytical queries on a large dataset?

Accepted Answer

Partition the table by a date or timestamp column.. Option B is correct because partitioning the table by a date or timestamp column lets BigQuery prune irrelevant partitions, so ad-hoc queries that filter on that column scan far less data and incur lower on-demand query costs. Option C is correct because materialized views precompute and cache the results of common aggregation queries, so repeated ad-hoc aggregations read the much smaller materialized view instead of rescanning the full large dataset. Option D is correct because clustering on columns frequently used in filter clauses co-locates related data in storage blocks, allowing BigQuery to skip blocks that don't match the filter and further reduce bytes scanned. Option A is not correct because automatic schema detection only simplifies loading data and has no effect on query cost. Option E is not correct because flat-rate pricing with reserved slots provides predictable capacity billing rather than reducing the cost of a sporadic ad-hoc query workload, which is typically cheaper on on-demand pricing.

Answer

Enable automatic schema detection to avoid manual schema definition.

Answer

Use flat-rate pricing with reserved slots.