Google PCA Practice Test 2 — 25 Questions

Question 1

An organization has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They launched a Compute Engine instance in subnet-a with an internal IP 10.0.1.2 and a public IP. They want the instance to only allow HTTPS traffic from the internet. Which firewall rule should they create?

Accepted Answer

Ingress rule: allow tcp:443, source 0.0.0.0/0, target tag 'https-server'. Option D is correct because the instance needs to accept incoming HTTPS traffic (TCP port 443) from the internet. An ingress firewall rule with source 0.0.0.0/0 allows traffic from any external IP, and applying it to instances with the target tag 'https-server' ensures only tagged instances are affected. This matches the requirement to allow only HTTPS from the internet.

Answer

Ingress rule: allow tcp:0-65535, source 0.0.0.0/0, target tag 'https-server'

Answer

Egress rule: allow tcp:443, destination 0.0.0.0/0, target tag 'https-server'

Answer

Ingress rule: allow tcp:443, source 10.0.0.0/16, target tag 'https-server'

Question 2

A company deploys a web application on Compute Engine behind a Global HTTPS Load Balancer. They need to restrict access to the application based on the client's IP address. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides IP-based access control at the edge of Google's network, integrated directly with the Global HTTPS Load Balancer. It allows you to create security policies with IP allow/deny rules that are evaluated before traffic reaches your Compute Engine instances, making it the appropriate service for client IP restriction at the load balancer level.

Answer

VPC firewall rules

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Question 3

An organization uses Cloud SQL for MySQL in a production environment. They need to ensure high availability with automatic failover in case of a zonal failure. Which configuration should they use?

Accepted Answer

Create a regional Cloud SQL instance with automatic failover.. A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

Answer

Create a read replica in a different region.

Answer

Export the database daily and import into a new instance if failure occurs.

Answer

Deploy Cloud SQL across multiple regions using cross-region replication.

Question 4

An organization deploys a microservices application on Google Kubernetes Engine (GKE) with multiple Deployments. They want to ensure that the application remains available during a cluster-wide upgrade. Which three best practices should they follow? (Choose three.)

Accepted Answer

Use multiple node pools across different zones.. To maintain availability during a GKE cluster upgrade, three best practices are: (1) Configure PodDisruptionBudgets (PDBs) for each deployment to limit the number of pods that can be disrupted simultaneously during voluntary disruptions like node upgrades. (2) Use multiple node pools across different zones to allow GKE to upgrade nodes one zone at a time, ensuring that replicas in other zones remain available. (3) Set up a load balancer with health checks so that traffic is only directed to healthy pods, automatically routing away from pods being terminated during the upgrade.

Answer

Enable cluster autoscaling.

Answer

Use StatefulSets instead of Deployments for all services.

Answer

Use node pools with multiple node types.

Question 5

A financial services company runs a multi-tier application on Compute Engine. They need to restrict network access so that only the web tier can communicate with the application tier, and only the application tier can access the database tier. All VMs are in the same VPC network. What is the most secure way to implement this?

Accepted Answer

Use VPC firewall rules with target tags to allow traffic between specific tiers.. VPC firewall rules with target tags allow you to precisely control ingress and egress traffic between VM instances based on their assigned tags. By tagging web tier VMs with a tag like 'web-tier' and application tier VMs with 'app-tier', you can create a firewall rule that allows traffic from 'web-tier' to 'app-tier' on the required port (e.g., TCP 8080) and another rule allowing traffic from 'app-tier' to 'db-tier' on the database port (e.g., TCP 3306). This approach enforces the principle of least privilege within a single VPC network without introducing unnecessary complexity or breaking network isolation.

Answer

Use Identity-Aware Proxy (IAP) to manage network access between tiers.

Answer

Create separate VPC networks for each tier and use VPC peering.

Answer

Assign a unique service account to each tier and use IAM conditions to restrict traffic.

Question 6

A healthcare organization uses Cloud Storage to store protected health information (PHI). They have a compliance requirement to ensure that all objects in the bucket are encrypted with a customer-managed key (CMK) that is rotated every 90 days. They also need to log all access to the bucket and detect anomalous access patterns. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle. Option D is correct because Cloud Storage with CMEK via Cloud KMS allows the organization to use a customer-managed key that can be rotated every 90 days, meeting the compliance requirement. Cloud Audit Logs capture all access to the bucket, and Chronicle provides advanced security analytics to detect anomalous access patterns, fulfilling the logging and detection needs.

Answer

Cloud Storage with default encryption, Cloud Audit Logs, and Security Command Center

Answer

Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud DLP

Answer

Cloud Storage with CSEK, Cloud Audit Logs, and Security Command Center

Question 7

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

Accepted Answer

Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.. Cloud DLP can be used to de-identify sensitive data like credit card numbers at rest in Cloud SQL, using deterministic or reversible transformations (e.g., format-preserving encryption or tokenization) that allow re-identification only by authorized applications. This approach minimizes application changes because DLP can scan and transform the data directly in the database, and the application can use re-identification transforms via the DLP API when needed, without modifying existing queries or schema.

Answer

Implement column-level encryption using Cloud KMS in the application layer.

Answer

Grant DBAs the Cloud SQL Viewer role to restrict access to data.

Answer

Use Cloud SQL Proxy to encrypt connections and limit DBA access.

Question 8

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

Accepted Answer

Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'. Option D is correct because the `iam.serviceAccount` condition attribute in IAM conditions allows you to restrict access based on the service account identity of the caller. When a Compute Engine instance uses a service account, the condition `iam.serviceAccount == "sa@project.iam.gserviceaccount.com"` ensures that only requests authenticated with that specific service account are allowed to access the Cloud Storage bucket. This is the standard IAM condition attribute for matching the service account of the requesting principal.

Answer

Condition: 'request.auth == "serviceAccount:sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'origin.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'resource.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Question 9

A developer ran the command `gcloud compute instances describe instance-1 --zone us-central1-a` and received the above output. They want to create another instance with the same configuration, except with a different external IP. Which action should they take?

Accepted Answer

Create a new instance without specifying a static IP, so it receives an ephemeral IP.. The `gcloud compute instances describe` output shows the instance has an external IP that is ephemeral (not reserved). To create a new instance with the same configuration but a different external IP, the simplest approach is to create a new instance without specifying a static IP, which will automatically assign a new ephemeral IP. This avoids the overhead of reserving and managing a static IP when only a temporary, different address is needed.

Answer

Reserve a new static external IP address and assign it to the new instance.

Answer

Use the same static IP address by releasing and reassigning it.

Answer

None of the above.

Question 10

A startup uses Cloud Functions with a Pub/Sub trigger to process incoming orders. They notice that the function sometimes fails to process messages, and those messages are lost. What is the most likely cause?

Accepted Answer

The Cloud Function is configured with retry on failure set to false.. Option D is correct because when a Cloud Function fails to process a Pub/Sub message and retry on failure is set to false, the message is not redelivered. Pub/Sub relies on the subscriber (the Cloud Function) to acknowledge messages; without retries, a failed execution causes the message to be dropped after the ack deadline expires, leading to message loss.

Answer

The subscription has an ackDeadlineSeconds of 600.

Answer

The Cloud Function has a timeout of 540 seconds.

Answer

The Pub/Sub topic has a retention duration of 10 minutes.

Question 11

Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?

Accepted Answer

Create separate subnets for each application tier.. Option B is correct because creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.

Answer

Disable VPC Flow Logs to reduce cost.

Answer

Use a single subnet for all tiers to simplify IP management.

Answer

Rely on the default priority of firewall rules to ensure proper ordering.

Question 12

A company is migrating hundreds of on-premises VMs to Compute Engine. They want to minimize manual effort and downtime. Which service should they use?

Accepted Answer

Migrate for Compute Engine. Migrate for Compute Engine (formerly Velostrata) is the correct choice because it is a fully managed service specifically designed for migrating large-scale VM workloads to Compute Engine with minimal downtime. It uses a streaming migration approach that moves the OS and application data while the source VM continues running, then performs a cutover with near-zero downtime, making it ideal for hundreds of VMs without manual effort.

Answer

Cloud Build

Answer

gcloud compute instances import

Answer

Transfer Appliance

Answer

CloudEndure

Question 13

A company is deploying a web application on Compute Engine behind a global HTTP(S) load balancer. They want to restrict access to only traffic from specific IP ranges. Which load balancer feature should they use?

Accepted Answer

Cloud Armor security policies.. Cloud Armor security policies are the correct choice because they allow you to define IP-based allow/deny rules at the edge of Google's network, directly integrated with the global HTTP(S) load balancer. This provides granular access control based on source IP ranges before traffic reaches your backend instances, which is exactly what the requirement specifies.

Answer

VPC firewall rules.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud CDN.

Question 14

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) across three zones in us-central1. The application uses a Cloud Spanner database. Recently, the application experienced increased latency and timeouts during peak hours. The operations team noticed that the MIG's CPU utilization is consistently above 80% during peak hours, and the autoscaler is configured to scale based on CPU utilization with a target of 60%. However, the autoscaler is not adding new instances quickly enough, causing performance degradation. The team also observed that new instances take over 5 minutes to become healthy and serve traffic. The health check is a simple TCP check on port 8080. The application startup script downloads large configuration files from Cloud Storage. What should the team do to improve the autoscaling response time and reduce latency?

Accepted Answer

Create a custom Compute Engine image that includes the application and configuration, and use it in the MIG.. Option C is correct because the primary bottleneck is the long instance startup time (over 5 minutes) caused by downloading large configuration files from Cloud Storage at boot. By creating a custom Compute Engine image that bakes the application and configuration into the image, new instances can start serving traffic almost immediately, drastically reducing the time before they become healthy and the autoscaler can consider them in scaling decisions. This directly addresses the root cause of slow autoscaling response, as the autoscaler cannot add instances faster than they become healthy.

Answer

Increase the minimum number of instances in the MIG to handle peak load.

Answer

Reduce the autoscaler target CPU utilization to 40% so it scales earlier.

Answer

Change the health check to HTTP and reduce the initial delay and check intervals.

Question 15

Which THREE of the following are best practices when using Deployment Manager to manage infrastructure? (Choose three.)

Accepted Answer

Use templates to define resources modularly.. Using templates promotes reusability and modularity. Imports allow you to define common resources across deployments. Composite types bundle related resources into a single entity. YAML files are basic, but using Python or Jinja allows dynamic generation. The three best practices are using templates, imports, and composite types.

Answer

Use raw REST API calls in templates.

Answer

Use only YAML configuration files.

Question 16

Your organization has a policy that all Compute Engine instances must have specific labels (env, team, cost-center) applied. You want to enforce this automatically when instances are created. What should you do?

Accepted Answer

Use the Organization Policy service with a custom constraint to require labels on Compute Engine instances.. Option D is correct because Organization Policy Service with a custom constraint allows you to enforce that all Compute Engine instances must have specific labels (env, team, cost-center) at creation time. This is a preventive control that blocks creation of non-compliant instances, unlike reactive or permission-based approaches. Custom constraints use the `compute.googleapis.com/instance` resource type and can require label keys or values using CEL (Common Expression Language) syntax.

Answer

Enable Cloud Audit Logs and set up a metric-based alert to detect instances without labels.

Answer

Create a Cloud Function that listens for instance creation events and adds labels automatically.

Answer

Assign a custom IAM role that includes permission to label instances, and remove the default compute.instances.create permission.

Question 17

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single on-premises server and uses a local MySQL database. The company wants to minimize changes to the application code while improving scalability and reliability. Which migration strategy should the architect recommend?

Accepted Answer

Rehost the application on Compute Engine and use Cloud SQL for MySQL as the database.. Option B is correct because rehosting (lift-and-shift) the monolithic application to Compute Engine with Cloud SQL for MySQL minimizes code changes while improving scalability and reliability. Cloud SQL provides managed MySQL with automated backups, replication, and failover, addressing the need for reliability without requiring application refactoring.

Answer

Refactor the application into microservices and deploy on Google Kubernetes Engine.

Answer

Containerize the application with Docker and run it on Cloud Run.

Answer

Migrate the database to Firestore and rewrite the application to use Firestore APIs.

Question 18

A company wants to enable a new DevOps team to have read-only access to logs in the default Cloud Logging bucket for their project, but prevent them from modifying log views or creating linked datasets in BigQuery. Which two IAM roles should be granted to the team?

Accepted Answer

roles/logging.viewAccessor. The roles/logging.viewAccessor role grants read-only access to log entries in Cloud Logging buckets, including the default bucket, without allowing modifications to log views or linked datasets. The roles/logging.viewer role provides broader read-only access to all Logging resources, including logs, but still prevents modifying log views or creating linked datasets in BigQuery. Together, these two roles satisfy the requirement of read-only log access while explicitly excluding permissions to alter log views or manage BigQuery linked datasets.

Answer

roles/logging.configWriter

Answer

roles/logging.admin

Answer

roles/bigquery.dataViewer

Question 19

An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?

Accepted Answer

Cloud DLP. Cloud DLP (option C) is correct because it provides native content inspection and de-identification (redaction) of sensitive data like credit card numbers using built-in infoType detectors. Cloud Functions (option D) is correct because it can be triggered by Cloud Storage events (e.g., finalize/create) to invoke the DLP API on newly uploaded CSV files, enabling serverless, event-driven processing without managing infrastructure.

Answer

Cloud Dataflow

Answer

Cloud Run

Answer

BigQuery

Question 20

A company is using Cloud NAT to allow instances in a private subnet to access the internet for updates. The security team wants to audit outbound connections. Which TWO steps should be taken to enable flow logs for Cloud NAT?

Accepted Answer

Configure a log sink to export Cloud NAT logs to BigQuery. Cloud NAT flow logs provide detailed records of outbound connections and are enabled directly on the Cloud NAT gateway itself. Option B is correct because configuring a log sink to export Cloud NAT logs to BigQuery is a valid step to audit outbound connections, but the primary step to enable logging is to update the existing Cloud NAT gateway to enable flow logs (Option E). Together, these two steps (B and E) allow you to capture and analyze outbound traffic for auditing.

Answer

Enable private Google access on the subnet

Answer

Enable VPC Flow Logs on the subnet

Answer

Create a new Cloud NAT gateway with logging enabled