Google PCA Practice Test 4 — 25 Questions

Question 1

A company needs a relational database that can scale horizontally across multiple regions, supports ACID transactions, and provides strong global consistency. Which Google Cloud database should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that offers horizontal scaling, ACID transactions, and strong global consistency across regions.

Answer

BigQuery

Answer

Cloud SQL

Answer

Firestore

Question 2

An e-commerce company is experiencing traffic spikes during flash sales. Their application runs on Compute Engine instances behind a TCP load balancer. They want to automatically scale the number of instances based on CPU utilization. Which configuration is required?

Accepted Answer

Create a managed instance group (MIG) with an autoscaling policy based on CPU utilization.. Managed Instance Groups (MIGs) with autoscaling based on CPU utilization is the correct approach. Cloud Functions and Cloud Run are not Compute Engine instance scaling. A global HTTP(S) Load Balancer is not required for TCP traffic.

Answer

Configure Cloud Run for autoscaling and rewrite the application to run in containers.

Answer

Create an unmanaged instance group with a static number of instances and configure Cloud CDN.

Answer

Use Cloud Functions to handle traffic spikes and redirect traffic from the load balancer.

Question 3

Refer to the exhibit. An application running on a GCE instance (ID: 1234567890) is unable to connect to a database at 10.0.0.1:5432. The logs show repeated 'Connection refused' errors. What is the most likely cause?

Accepted Answer

The database service is not running or is not listening on port 5432.. The 'Connection refused' error indicates that the TCP handshake was rejected by the target host, which typically means the database service is not actively listening on port 5432. This is distinct from a firewall block, which would result in a timeout or 'no route to host' error. Since the error is immediate and specific to port 5432, the most likely cause is that the PostgreSQL or other database service is not running or is bound to a different interface/port.

Answer

The firewall rule allowing traffic on port 5432 is missing or misconfigured.

Answer

The instance is using an outdated SSL certificate.

Answer

The VPC network has no route to the database subnet.

Question 4

The exhibit shows a Cloud Storage bucket configuration. What does this configuration ensure?

Accepted Answer

Objects can only be permanently deleted after the retention period expires.. The exhibit shows a bucket configured with a retention policy. When a retention policy is set on a Cloud Storage bucket, objects cannot be deleted or overwritten until the retention period expires. This ensures that objects can only be permanently deleted after the retention period ends, which is exactly what option C describes.

Answer

Older versions of objects are automatically transferred to a different storage class.

Answer

Data is replicated to another region for disaster recovery.

Answer

Objects older than 30 days will be automatically deleted.

Question 5

Match each IAM role type to its description.

Accepted Answer

Basic roles: Broad roles that apply to all resources in a project (Owner, Editor, Viewer). In GCP, IAM roles are categorized into basic (broad), predefined (service-specific), and custom (user-defined). Common confusions arise between predefined and custom roles.

Answer

Basic roles: Roles curated by Google Cloud that provide fine-grained access for specific services

Answer

Predefined roles: Roles that you create to tailor permissions to your organization's specific needs

Question 6

A small company wants to store sensitive files in Cloud Storage and ensure they are encrypted with a key that they control and rotate automatically every 90 days. They are currently using the default encryption provided by Google Cloud. They need a solution that is easy to manage and does not require manual key rotation. What should they do?

Accepted Answer

Create a Cloud KMS key ring and key with CMEK, set a rotation period of 90 days, and configure the bucket to use that key.. Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow the company to control the key while leveraging automatic rotation. By creating a key ring and key with a 90-day rotation period, and configuring the Cloud Storage bucket to use that key, the company meets the requirement for automated rotation without manual intervention. This solution is easy to manage and integrates natively with Cloud Storage, avoiding the complexity of external encryption or scripting.

Answer

Use Cloud HSM to generate a key and handle encryption outside of Cloud Storage.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and write a script to rotate the key every 90 days.

Answer

Continue using default encryption as it is automatically rotated by Google.

Question 7

Refer to the exhibit. What is the primary benefit of the `--preemptible` flag in this command?

Accepted Answer

Significant cost reduction compared to standard instances.. The `--preemptible` flag in Google Cloud Platform (GCP) creates preemptible VM instances, which are short-lived, cost-effective instances that can be terminated at any time by GCP. The primary benefit is a significant cost reduction—up to 60-91% lower than standard instances—making them ideal for batch jobs, fault-tolerant workloads, and non-critical tasks. This flag does not affect startup time, availability guarantees, or provide free access to specialized hardware.

Answer

Faster instance startup time due to optimized kernel.

Answer

Higher availability through automatic restart on failure.

Answer

Access to specialized hardware like GPUs at no extra cost.

Question 8

An organization is implementing a data loss prevention (DLP) strategy for Cloud Storage. They want to automatically scan new objects uploaded to a specific bucket and redact sensitive data. Which service and configuration should they use?

Accepted Answer

Use Cloud Functions triggered by Cloud Storage events to call Cloud DLP API for each new object, and then store the redacted version.. It uses Cloud Functions as an event-driven compute service that triggers on Cloud Storage object finalize events. The function then calls the Cloud DLP API to inspect and redact sensitive data from the new object, and writes the redacted version back to the bucket. This provides automatic, near-real-time scanning and redaction for each uploaded object, aligning with the requirement for an automated DLP strategy.

Answer

Configure Cloud Armor with a WAF rule to inspect and redact data as it enters the bucket.

Answer

Enable Security Command Center (SCC) premium tier and configure it to scan the bucket for sensitive data.

Answer

Use Cloud DLP with a BigQuery external table to scan the bucket contents periodically.

Question 9

A company runs a batch processing job that uses preemptible VMs. The job occasionally fails due to VM preemption. They want to improve reliability without significantly increasing cost. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Use a managed instance group with autoscaling and preemptible VMs. Option A is correct because a managed instance group (MIG) with autoscaling and preemptible VMs automatically maintains the desired number of instances, replacing preempted VMs with new ones so the batch job can continue running with minimal disruption and without paying for non-preemptible capacity. Option D is correct because preemptible VMs can be reclaimed at any time, so building a retry mechanism into the job lets failed tasks be re-run on surviving or replacement instances, directly improving reliability at essentially no extra cost. Option B is not appropriate because sole-tenant nodes isolate hardware for compliance/licensing reasons and do not reduce the risk of preemption. Option C would improve reliability but significantly increases cost, which the scenario explicitly wants to avoid. Option E merely adds more preemptible VMs; it does not address task recovery and still leaves the job vulnerable to preemption.

Answer

Use sole-tenant nodes to reduce risk of preemption

Answer

Switch to regular (non-preemptible) VMs

Answer

Increase the number of preemptible VMs

Question 10

An organization wants to deploy a containerized microservices architecture on Google Kubernetes Engine (GKE) and minimize operational overhead. They do not need to manage the node infrastructure and are willing to accept some limitations on node configuration. Which GKE mode should they choose?

Accepted Answer

GKE Autopilot mode. GKE Autopilot mode is a fully managed Kubernetes experience where Google manages the control plane and the nodes, including provisioning, scaling, and security patching. It minimizes operational overhead because users only deploy workloads and pay for the resources their pods consume, without managing node pools. The scenario explicitly accepts limitations on node configuration, which aligns with Autopilot's opinionated, hardened node management.

Answer

GKE Standard mode with zonal cluster

Answer

Compute Engine with container-optimized OS and instance groups

Answer

Cloud Run for Anthos

Question 11

A company runs a web application on Compute Engine behind a HTTP(S) Load Balancer. They want to reduce latency for users worldwide. Which Google Cloud service should they use?

Accepted Answer

Cloud CDN. Cloud CDN caches content at Google's globally distributed edge points of presence, reducing latency by serving requests from locations closer to users. It integrates directly with HTTP(S) Load Balancer to accelerate web application delivery worldwide.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Cloud VPN

Question 12

A company runs a stateful workload on Compute Engine with regional persistent disks (PD). They need to implement a disaster recovery (DR) plan with a Recovery Point Objective (RPO) of less than 1 hour and Recovery Time Objective (RTO) of less than 4 hours. Which THREE steps should they include in their DR plan? (Choose three.)

Accepted Answer

Take snapshots of the persistent disk every 30 minutes and copy them to a Cloud Storage bucket in another region. Taking snapshots every 30 minutes meets the RPO of less than 1 hour. By copying these snapshots to a Cloud Storage bucket in another region, you ensure data is available in a DR region for recovery, which is essential for cross-region disaster recovery.

Answer

Create a snapshot schedule for the persistent disk every 4 hours

Answer

Use regional persistent disks to automatically replicate data to a second zone

Question 13

A company is using Cloud Storage for backups and wants to minimize costs. The backups are accessed infrequently and can tolerate retrieval delays. Which storage class is most appropriate?

Accepted Answer

Archive. Archive storage class is the most cost-effective option for backups that are accessed infrequently and can tolerate retrieval delays. It offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of minutes to hours, making it ideal for long-term backup data that does not require immediate access.

Answer

Standard

Answer

Coldline

Answer

Nearline

Question 14

A company wants to monitor the health of their Cloud Run services. Which THREE metrics should they use to define a comprehensive health SLI? (Choose 3)

Accepted Answer

Latency (e.g., p99 response time). Latency (p99 response time) is a critical metric for Cloud Run because it measures the end-to-end request processing time, directly reflecting user experience. In a serverless environment, high latency can indicate cold starts, insufficient concurrency, or downstream service bottlenecks, making it essential for a comprehensive health SLI.

Answer

CPU utilization

Answer

Instance count

Question 15

An organization is using Cloud Interconnect to connect their on-premises network to Google Cloud. They need to ensure 99.99% availability for their connection. Which configuration meets this requirement?

Accepted Answer

Two Dedicated Interconnect connections from different edge locations. To achieve 99.99% availability with Cloud Interconnect, Google Cloud requires two Dedicated Interconnect connections in different edge locations (or two Partner Interconnect connections in different metros). This redundant topology eliminates single points of failure at the interconnect level, meeting the SLA for 99.99% availability. A single connection, regardless of bandwidth, cannot meet this SLA.

Answer

A single Partner Interconnect connection at 1Gbps

Answer

A single Dedicated Interconnect connection at 10Gbps

Answer

High Availability VPN (HA VPN) with two gateways and four tunnels

Question 16

Which Google Cloud service provides a fully managed, serverless data warehouse for petabyte-scale analytics using SQL?

Accepted Answer

BigQuery. BigQuery is Google Cloud's fully managed, serverless data warehouse designed for petabyte-scale analytics using standard SQL. It automatically handles infrastructure scaling, partitioning, and query optimization, allowing users to run fast SQL queries on massive datasets without managing servers or clusters.

Answer

Firestore

Answer

Cloud Spanner

Answer

Cloud SQL

Question 17

A company is designing a VPC Service Controls perimeter to protect data stored in Google Cloud. They need to allow access from their on-premises network via a Cloud VPN tunnel while blocking all internet-based access. What is the most secure and manageable approach?

Accepted Answer

Configure a VPC Service Controls perimeter and create an access level that includes the on-premises CIDR range.. VPC Service Controls (VPC SC) is the only Google Cloud-native mechanism that can create a security perimeter around managed services (like Cloud Storage, BigQuery) and restrict access based on an access level that includes the on-premises CIDR range. This ensures that only traffic originating from the on-premises network (via the Cloud VPN tunnel) is allowed, while all internet-based access is blocked, even if the request uses valid credentials. Firewall rules alone cannot restrict access to Google-managed APIs, and Private Google Access does not enforce a perimeter around services.

Answer

Configure firewall rules to only allow traffic from the on-premises CIDR to the VPC.

Answer

Use Cloud VPN and Private Google Access to allow on-premises access without public IPs.

Answer

Use Cloud IAP (Identity-Aware Proxy) to restrict access based on identity and context.

Question 18

During a load test, an application running on GKE experiences high latency and errors. You suspect the issue is due to insufficient cluster resources. Which gcloud command should you use to quickly check the current resource utilization of all nodes in the cluster?

Accepted Answer

gcloud compute instances list. None of the listed gcloud commands shows current resource utilization of GKE nodes. gcloud container clusters describe shows configuration, gcloud container clusters list lists clusters, gcloud container clusters get-credentials retrieves credentials, and gcloud compute instances list only lists instances and their status. The correct command for current CPU/memory utilization is kubectl top nodes.

Answer

gcloud container clusters describe

Answer

gcloud container clusters list

Answer

gcloud container clusters get-credentials

Question 19

A company wants to ensure that all access to their Cloud Storage bucket is logged for compliance purposes. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs (Option B) are required to log every API call that reads, writes, or deletes data in a Cloud Storage bucket, such as object GETs and PUTs. Admin Activity logs only record configuration changes, not data access, so they would not capture the read/write operations needed for compliance logging.

Answer

Admin Activity audit logs

Answer

System Event audit logs

Answer

Access Transparency logs

Question 20

Which Google Cloud service automatically computes the optimal size or tier for underutilized Compute Engine instances and generates recommendations to reduce cost?

Accepted Answer

Recommender (Active Assist). Recommender (part of Active Assist) analyzes Compute Engine utilization and automatically generates rightsizing recommendations to reduce cost by resizing underutilized VMs. It is the GCP service specifically built to surface optimal machine type and size suggestions.

Answer

Cloud Monitoring

Answer

Cloud Profiler

Answer

Cost Management