Google PCA Practice Test 4 — 25 Questions

Question 1

A healthcare organization is storing sensitive patient data in Cloud Storage. They need to ensure that all objects are encrypted with a key managed by their on-premises HSM. Which encryption approach should they use?

Accepted Answer

Use Cloud External Key Manager (EKM) with a key hosted on the on-premises HSM.. Cloud External Key Manager (EKM) allows you to use an external key management system, such as an on-premises HSM, to manage encryption keys for Google Cloud services. This approach meets the requirement because the key never leaves the HSM, and Cloud Storage uses the key via the EKM integration, ensuring the organization retains full control over the key lifecycle.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and store the key in a Secret Manager accessible only from the on-premises HSM.

Answer

Use Customer-Managed Encryption Keys (CMEK) with a Cloud KMS key that is generated from the on-premises HSM.

Answer

Encrypt each object client-side with a key from the on-premises HSM before uploading to Cloud Storage.

Question 2

A company uses Cloud KMS to encrypt sensitive data. They need to ensure that encryption key usage is audited and that keys are rotated automatically every 30 days. Which two actions should they take? (Choose two.)

Accepted Answer

Enable Data Access audit logs for the Cloud KMS API. Option A is correct because enabling Data Access audit logs for the Cloud KMS API captures detailed information about every encryption key usage, including who accessed the key, when, and what operation was performed. This meets the auditing requirement by recording all key usage events in Cloud Audit Logs, which can be reviewed for compliance and security analysis.

Answer

Create a Cloud Trigger to manually rotate the key every month

Answer

Enable Cloud Key Management Service's key usage monitoring

Answer

Use Cloud External Key Manager to rotate keys externally

Question 3

A company is designing a data processing pipeline in Google Cloud that must be HIPAA compliant. Which three security features should they implement? (Choose three.)

Accepted Answer

Encrypt data in transit using TLS. Encrypting data in transit using TLS is a mandatory security control for HIPAA compliance because it protects electronic protected health information (ePHI) from interception during transmission over networks. TLS 1.2 or higher ensures that data moving between clients, services, and Google Cloud endpoints is encrypted, meeting the HIPAA Security Rule requirement for integrity and confidentiality of ePHI in transit.

Answer

Enable Data Loss Prevention (DLP) for data classification

Answer

Use Cloud CDN for faster delivery

Question 4

What is the effective access of the service account sa@project.iam.gserviceaccount.com to the bucket?

Accepted Answer

Full admin access to objects. The service account sa@project.iam.gserviceaccount.com is a Google Cloud IAM service account. When it is granted the 'Storage Admin' role (roles/storage.admin) at the project level, it gains full admin access to all buckets in the project, including the ability to create, delete, and manage objects. This role provides full control over objects, equivalent to 'Full admin access to objects'.

Answer

Owner access

Answer

Read-only access

Answer

No access

Question 5

Which THREE services can be used to audit changes to resources in a Google Cloud project?

Accepted Answer

Security Command Center. Security Command Center (A) is correct because it provides a centralized view of security risks, including audit capabilities for resource changes via its 'Event Threat Detection' and 'Asset Inventory' features, which log and alert on modifications to Google Cloud resources. It integrates with Cloud Audit Logs to surface security-relevant changes, making it a valid service for auditing changes.

Answer

Cloud Monitoring

Answer

Cloud Endpoints

Question 6

A company is using Cloud SQL with automatic backups enabled. They want to ensure that backups are encrypted with a customer-managed key (CMEK) and that the key used for backups is different from the one used for the database itself. How can they achieve this?

Accepted Answer

When creating the Cloud SQL instance, specify a CMEK for the database using 'root.encryptionKeyName' and a different CMEK for backups using 'backup.encryptionKeyName'.. Option A is correct because Cloud SQL supports specifying separate CMEKs for the database and its backups via the `root.encryptionKeyName` and `backup.encryptionKeyName` fields when creating the instance. This allows you to use a customer-managed key for the database and a different customer-managed key for automatic backups, meeting the requirement for key separation.

Answer

Create a Cloud KMS key ring with two keys, and use one key for the database and the other for backups, but Cloud SQL does not support separate keys.

Answer

Use the same CMEK for both the database and backups, as separate keys are not supported.

Answer

Enable CMEK on the Cloud SQL instance, and the backups will automatically use the same key.

Question 7

Which TWO practices improve the security of a Cloud Run service?

Accepted Answer

Enable Cloud Armor for the service.. A is correct because Cloud Armor provides web application firewall (WAF) capabilities that protect Cloud Run services from common web attacks like SQL injection and cross-site scripting (XSS). B is correct because Identity-Aware Proxy (IAP) verifies user identity and context before allowing access, enforcing authentication at the Google Cloud edge before requests reach the Cloud Run service.

Answer

Run the service in a VPC with firewall rules.

Answer

Use a canary deployment strategy.

Answer

Require client-side TLS certificates.

Question 8

A company has a multi-project Google Cloud environment with strict compliance requirements. They need to ensure that all projects enforce a uniform set of constraints, such as requiring CMEK for Compute Engine disk encryption and blocking the use of public IPs on VMs. They have defined these constraints using Organization Policies at the organization level. However, the security team discovers that some projects are not enforcing the constraints because they have been overridden at the project level by the respective project owners. The security team wants a solution that prevents project-level overrides while maintaining the ability to apply exceptions at a folder level when approved. What should they do?

Accepted Answer

Move all projects under a common folder and set the Organization Policies at that folder level with 'enforce: true'.. Option D is correct because setting the Organization Policy at the folder level (e.g., a 'compliance' folder that contains all projects) with 'enforce: true' ensures that project-level overrides are blocked while still allowing folder-level exceptions if approved. Option A is wrong because manually removing overrides is not scalable and does not prevent future overrides. Option B is wrong because Cloud Asset Inventory is for auditing, not enforcement. Option C is wrong because Forseti Security is a security tool but does not provide the policy enforcement mechanism of Organization Policies.

Answer

Deploy Forseti Security to automatically remediate when projects override policies.

Answer

Use Cloud Asset Inventory to monitor for non-compliant projects and alert the security team.

Answer

Manually remove the overridden policies in each project and set the constraints at the organization level again.

Question 9

A developer is trying to deploy a Compute Engine instance from a Cloud Build step. The build fails with the above error. What is the problem?

Accepted Answer

Cloud Build does not have the 'iam.serviceAccounts.actAs' permission on the default compute service account.. The error occurs because Cloud Build needs to impersonate the Compute Engine default service account to create a VM instance. The Cloud Build service account requires the 'iam.serviceAccounts.actAs' permission on the target service account to delegate its identity. Without this permission, the build step fails even if the Cloud Build service account has 'compute.instances.create' permission.

Answer

The project has exceeded its service account quota.

Answer

The Cloud Build service account lacks 'compute.instances.create' permission.

Answer

The developer's personal account does not have permission to use Cloud Build.

Question 10

A company monitors their application with Cloud Monitoring. They set up an alerting policy to notify the on-call team when the 99th percentile latency exceeds 500 ms for 5 minutes. However, they receive false positive alerts due to short bursts. How should they refine the policy?

Accepted Answer

Increase the evaluation window to 10 minutes.. Option D is correct because increasing the evaluation window to 10 minutes smooths out short bursts of high latency, ensuring the alert triggers only when the 99th percentile latency exceeds 500 ms for a sustained period. Cloud Monitoring evaluates metrics over the specified window, so a longer window reduces false positives from transient spikes while still detecting genuine degradation.

Answer

Set up alerting on each data point individually.

Answer

Decrease the threshold to 400 ms.

Answer

Change the metric to average latency instead of 99th percentile.

Question 11

A company uses Cloud Spanner for a global financial application. They experience increased latency and transaction aborts during peak hours. Which measure should they take first to improve reliability?

Accepted Answer

Optimize transactions to reduce lock contention.. Option C is correct because transaction aborts and latency in Cloud Spanner are most commonly caused by lock contention during peak hours. By optimizing transactions—such as reducing their scope, using read-only transactions where possible, and avoiding hot-spot writes—you directly address the root cause of contention without incurring additional cost or schema changes. This aligns with Google's best practices for Spanner reliability.

Answer

Increase the number of nodes in the Spanner instance.

Answer

Reduce the number of indexes on frequently updated columns.

Answer

Use interleaved tables to co-locate related data.

Question 12

A company uses Cloud CDN to accelerate content delivery. They notice that some users receive stale content even after purging the cache. Which THREE factors could cause this?

Accepted Answer

The purge request did not complete successfully.. Option B is correct because a purge request that does not complete successfully will leave cached content intact, causing users to receive stale data. Cloud CDN processes purge requests asynchronously, and if the request fails (e.g., due to network issues or invalid paths), the cache is not invalidated. This directly explains why stale content persists despite an attempted purge.

Answer

The content is compressed with gzip.

Answer

The CDN is configured with signed URLs.

Question 13

An organization uses Cloud Functions (2nd gen) for event-driven processing. They notice that some functions fail with 'memory limit exceeded' errors during peak load. The function processes messages from Pub/Sub and writes to Firestore. What should they do to improve reliability without sacrificing throughput?

Accepted Answer

Increase the memory allocated to the Cloud Function.. The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.

Answer

Increase the maximum number of concurrent function instances.

Answer

Enable Pub/Sub batching to reduce the number of function invocations.

Answer

Split the function into multiple smaller functions, each handling a subset of the data.

Question 14

A company is using Cloud Load Balancing with backend services across multiple regions. They notice that traffic is not being evenly distributed and some backends are overloaded. Which configuration should they check?

Accepted Answer

Session affinity settings. Session affinity (sticky sessions) directs all requests from a single client to the same backend instance. If enabled, this can cause uneven load distribution because certain clients may generate disproportionately more traffic, overloading their pinned backends while others remain underutilized. Disabling or properly configuring session affinity allows the load balancer to distribute requests based on its default algorithm (e.g., round-robin or least-connections), improving balance across backends.

Answer

Firewall rules

Answer

Cloud CDN caching

Answer

Health check frequency

Question 15

A developer runs the command above and sees the output. The cluster has one node pool with 3 nodes, each of type e2-standard-4 (4 vCPU, 16 GB RAM). The application requires at least 2 GB of memory per pod and the cluster has 10 pods that need to be scheduled. The developer also notices that the node pool autoscaling is enabled with a minimum of 1 and maximum of 5 nodes. However, the cluster is unable to schedule all pods. What is the most likely cause?

Accepted Answer

The pod resource requests exceed the allocatable resources on the existing nodes after accounting for system reservations.. Option D is correct because the cluster has 3 e2-standard-4 nodes, each with 4 vCPU and 16 GB RAM. After accounting for system reservations (e.g., kubelet, OS, daemonsets), the allocatable memory per node is typically around 13-14 GB. With 10 pods each requesting 2 GB, the total memory request is 20 GB, but the total allocatable memory across 3 nodes is only about 39-42 GB. However, the autoscaler can only scale up to 5 nodes, and even then, the total allocatable memory would be around 65-70 GB, which is sufficient. The most likely cause is that the pod resource requests exceed the allocatable resources on the existing nodes, preventing scheduling, and the autoscaler may not have triggered yet or is constrained by other factors like CPU or node limits.

Answer

The cluster is running an older version of Kubernetes that does not support node auto-scaling.

Answer

The node pool autoscaler is not properly configured to scale up based on pod resource requests.

Answer

The node auto-repair feature is disabled, causing a node to be unhealthy.

Question 16

Which TWO actions should you take to improve the reliability of a stateful application deployed on Compute Engine with regional persistent disks?

Accepted Answer

Use a regional persistent disk to replicate data across two zones.. Option A is correct because regional persistent disks (RPDs) synchronously replicate data between two zones within a region, ensuring that if one zone fails, the data remains available in the other zone without data loss. This directly improves the reliability of a stateful application by providing a durable, zone-failure-tolerant storage layer that maintains data consistency across zones.

Answer

Use preemptible VMs to reduce costs.

Answer

Place an HTTP(S) load balancer in front of the application.

Answer

Schedule regular snapshots of the persistent disk to Cloud Storage.

Question 17

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

Accepted Answer

Attach an IAM policy to an organization. Attaching an IAM policy to an organization (option A) is a valid method because it allows you to set organization-wide policies that apply to all projects and resources within that organization. This is a fundamental feature of Google Cloud's hierarchical resource management, where policies can be inherited from the organization node down to folders and projects, enabling centralized control over access.

Answer

Attach an IAM policy to a user

Answer

Assign an IAM role directly to a user

Answer

Attach an IAM policy to a service account

Question 18

An engineer runs the above command and sees two firewall rules that allow SSH access. A security review requires that SSH access be allowed only from the bastion subnet 10.0.1.0/24. What should the engineer do to meet the requirement?

Accepted Answer

Delete the allow-ssh-ingress rule. The correct answer is C because the allow-ssh-ingress rule has a higher priority (lower number) than the allow-ssh-from-bastion rule, allowing SSH from any source IP. Deleting this rule ensures that only the lower-priority rule (allow-ssh-from-bastion) remains, which restricts SSH access to the bastion subnet 10.0.1.0/24. In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence, so the allow-ssh-ingress rule (priority 1000) overrides the allow-ssh-from-bastion rule (priority 2000) for any traffic matching both.

Answer

Add a firewall rule with priority 500 that denies SSH from all IPs

Answer

Change the priority of allow-ssh-ingress to 2000

Answer

Remove the target tag 'ssh-allowed' from allow-ssh-from-bastion

Question 19

Which THREE are best practices for managing secrets (e.g., API keys, passwords) in Google Cloud? (Select exactly 3.)

Accepted Answer

Rotate secrets regularly and automatically where possible.. Option A is correct because regular, automated rotation of secrets limits the window of exposure if a secret is compromised. Secret Manager supports automatic rotation policies with a rotation period and next rotation time, and can trigger a Cloud Function or Cloud Run service to generate a new secret version, ensuring secrets are rotated without manual intervention.

Answer

Encrypt secrets and store them in source code repositories.

Answer

Pass secrets as environment variables to Compute Engine instances.

Question 20

A company is using Cloud Bigtable for time-series data from IoT devices. They are experiencing high latency for queries that scan a large range of rows. Which THREE actions can improve query performance? (Choose three.)

Accepted Answer

Reduce the size of row keys.. Reducing the size of row keys (A) improves query performance because Bigtable stores rows sorted by key, and smaller keys reduce the amount of data that must be scanned and transferred during range scans. This directly lowers I/O and network overhead, which is critical for time-series data where row keys often include timestamps and device IDs.

Answer

Use Key Visualizer to analyze access patterns.

Answer

Switch from SSD storage to HDD storage.