Google PCA Practice Test 5 — 25 Questions

Question 1

A company is migrating sensitive customer data to Google Cloud. They need to ensure data is encrypted at rest and in transit. Which Google Cloud service provides a centralized way to manage encryption keys used by Google Cloud services?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct choice because it provides a centralized, managed service for creating, rotating, and destroying encryption keys used by Google Cloud services. It integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest, and it supports customer-managed encryption keys (CMEK) for granular control. For data in transit, Cloud KMS can be used to manage keys for TLS or application-level encryption, though Google Cloud automatically encrypts all network traffic by default.

Answer

Cloud HSM

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Secret Manager

Question 2

Which TWO are recommended practices for securing a Kubernetes Engine (GKE) cluster?

Accepted Answer

Enable Binary Authorization to ensure only signed container images are deployed.. Option B is correct because Binary Authorization enforces that only container images signed by trusted authorities (e.g., during a CI/CD pipeline) can be deployed to the cluster. This integrates with Google Cloud's Attestation Authority and ensures supply chain security by verifying signatures against a policy before admission.

Answer

Disable HTTP load balancing to reduce attack surface.

Answer

Use the default Compute Engine service account for all GKE nodes.

Answer

Enable basic authentication for easier access management.

Question 3

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

Accepted Answer

A firewall rule with the name 'my-firewall' already exists in the project.. Option C is correct because the error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Answer

The user lacks IAM permissions to create firewall rules.

Answer

The network reference in the firewall rule is incorrect.

Answer

The deployment does not include a 'delete' policy for existing resources.

Question 4

A company is designing a disaster recovery plan for a critical application running on Compute Engine with a regional persistent disk. They want to minimize recovery time objective (RTO) and recovery point objective (RPO). Which TWO strategies should they implement? (Choose two.)

Accepted Answer

Use snapshot replication to a secondary region.. Option A is correct because snapshot replication to a secondary region allows you to create and store disk snapshots in a different region, enabling rapid recovery of the application in that secondary region. This minimizes RTO by having the snapshots readily available for creating new disks and instances, and minimizes RPO by scheduling frequent, automated snapshots that capture incremental changes, ensuring data loss is limited to the snapshot interval.

Answer

Take manual snapshots after a failure occurs.

Answer

Create an instance template in the same region.

Answer

Store backups in Cloud Storage with a lifecycle policy.

Question 5

An organization runs a Kubernetes cluster on GKE with cluster autoscaling enabled. They notice that pods are frequently in 'Pending' state due to insufficient CPU, but the cluster autoscaler does not add nodes quickly enough. What is the most likely cause?

Accepted Answer

The node pool has reached the maximum node count limit.. Option D is correct because the cluster autoscaler cannot add new nodes if the node pool has already reached its maximum node count limit. This limit is configured at the node pool level in GKE, and once reached, the autoscaler will not scale up further, leaving pods in 'Pending' state due to insufficient CPU resources.

Answer

The cluster autoscaler is using the 'least-waste' expander.

Answer

The horizontal pod autoscaler (HPA) is misconfigured.

Answer

The pod disruption budget (PDB) is too restrictive.

Question 6

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Accepted Answer

Grant the service account roles/storage.objectViewer on the bucket and remove all other bindings.. Option D is correct because the principle of least privilege dictates that the service account should be granted only the minimal permissions required to read objects, which is roles/storage.objectViewer. By removing all other bindings, the bucket becomes accessible exclusively to that service account, ensuring that no other identities (users, groups, or other service accounts) can read the sensitive data. This approach directly enforces the requirement using IAM roles on the bucket resource.

Answer

Grant the service account roles/iam.serviceAccountUser on the bucket.

Answer

Use a signed URL to allow access for the service account.

Answer

Grant the service account roles/storage.admin on the bucket.

Question 7

A company is migrating its on-premises Oracle database to Cloud SQL for PostgreSQL. The database team wants to minimize downtime during migration. Which approach should they use?

Accepted Answer

Use Database Migration Service for PostgreSQL with continuous migration from Oracle via Homogeneous Migration.. Database Migration Service (DMS) for PostgreSQL with continuous migration is the correct approach because it supports ongoing change data capture (CDC) from Oracle to Cloud SQL for PostgreSQL, enabling near-zero downtime. DMS handles schema conversion and data replication continuously, allowing the target to stay synchronized until a cutover, which minimizes downtime compared to batch methods.

Answer

Set up Oracle GoldenGate to replicate to Cloud SQL.

Answer

Take a physical backup of Oracle and restore to Cloud SQL.

Answer

Export the database as a dump file, upload to Cloud Storage, and import into Cloud SQL.

Question 8

A company wants to reduce costs for a Cloud Storage bucket that stores infrequently accessed archival data. The data is accessed roughly once a quarter. Which storage class should they use?

Accepted Answer

Archive storage class.. The Archive storage class is the correct choice because it is designed for data accessed less than once a year, making it ideal for quarterly-accessed archival data. It offers the lowest storage cost among Google Cloud Storage classes, though it incurs higher retrieval costs and a minimum 365-day storage duration, which aligns with infrequent access patterns.

Answer

Nearline storage class.

Answer

Standard storage class.

Answer

Coldline storage class.

Question 9

An e-commerce platform uses Cloud Spanner for order processing. Recently, latency spikes have occurred during flash sales. The team suspects hot spots due to monotonically increasing order IDs. Which table design change would best solve this?

Accepted Answer

Add a random prefix to the order ID primary key.. Monotonically increasing primary keys (like sequential order IDs) cause hot spots in Cloud Spanner because all writes are directed to a single split (tablet), overwhelming that node. Adding a random prefix (e.g., a hash of the customer ID) distributes writes across multiple splits, eliminating the hot spot and reducing latency spikes during high-throughput flash sales.

Answer

Remove the primary key and let Spanner auto-generate it.

Answer

Use interleaved tables to store orders under customers.

Answer

Create a secondary index on the timestamp column.

Question 10

A developer runs the command above. The instance is created successfully, but cannot be reached via HTTP from the internet. What is the most likely cause?

Accepted Answer

There is no firewall rule allowing ingress traffic on ports 80 and 443.. The most likely cause is that there is no firewall rule allowing ingress traffic on ports 80 and 443. By default, Google Cloud Platform (GCP) firewall rules block all incoming traffic from the internet. Even though the instance is created successfully, HTTP/HTTPS traffic cannot reach it unless a firewall rule explicitly permits ingress on TCP ports 80 and 443, typically via a target tag like 'http-server' or 'https-server'.

Answer

The machine type n1-standard-2 is not suitable for HTTP.

Answer

The image family debian-10 does not support HTTP.

Answer

The boot disk type pd-standard is too slow.

Question 11

A developer is deploying a containerized application to Cloud Run. The deployment fails with the error above. What is the most likely cause?

Accepted Answer

The container is listening on port 3000 instead of 8080.. Cloud Run requires containers to listen on the port defined by the `PORT` environment variable, which defaults to 8080. If the container is hardcoded to listen on port 3000, Cloud Run's health checks and routing will fail because the runtime cannot reach the application on the expected port, causing the deployment to fail.

Answer

The container health check is misconfigured.

Answer

The container startup script fails.

Answer

The container does not have a web server.

Question 12

Which TWO methods can be used to restrict inbound traffic to a Compute Engine instance to only specific IP addresses without relying on instance-level firewall rules? (Choose 2)

Accepted Answer

Create firewall rules in the VPC network. Option C is correct because VPC firewall rules operate at the network level, not the instance level, and can be configured to allow inbound traffic only from specific source IP ranges (e.g., using the 'sourceRanges' field). These rules are applied to all instances in the VPC or subnet, independent of any instance-level configuration, making them a valid method to restrict traffic without relying on instance-level firewall rules.

Answer

Use VPC Service Controls

Answer

Configure Cloud Armor policies

Answer

Assign a service account to the instance

Question 13

A developer wants to store and retrieve non-relational data with flexible schema and automatic scaling. Which Google Cloud service should they use?

Accepted Answer

Firestore.. Firestore is a NoSQL document database that supports flexible schema and automatic scaling, making it ideal for non-relational data. It offers real-time synchronization, offline support, and serverless scaling, which aligns with the requirement for storing and retrieving data without manual sharding or capacity planning.

Answer

Cloud Bigtable.

Answer

Cloud SQL.

Answer

Cloud Spanner.

Question 14

Which THREE components are required to set up a private connection between an on-premises network and a VPC using Cloud VPN? (Choose three.)

Accepted Answer

Peer VPN gateway (on-premises).. Option A is correct because a Peer VPN gateway represents the on-premises VPN device that terminates the IPsec tunnel from the Cloud VPN gateway. This is a required component to establish the encrypted tunnel between your on-premises network and the VPC, as it defines the public IP address and configuration of the remote endpoint.

Answer

VPC Network Peering.

Answer

Cloud Router.

Question 15

You are reviewing an IAM policy for a Cloud Storage bucket. Alice is a member of the data-team group. What level of access does Alice have to objects in this bucket?

Accepted Answer

Read and write access (admin).. Option C is correct because the IAM policy grants the data-team group the roles/storage.objectAdmin role, which provides full read, write, and delete access to objects in the bucket. Alice, as a member of the data-team group, inherits this role and therefore has read and write (admin) access to the objects.

Answer

Read-only access.

Answer

No access, because the group policy overrides the individual policy.

Answer

Write-only access.

Question 16

Which THREE actions can help reduce costs for a BigQuery workload that runs frequent, ad-hoc analytical queries on a large dataset?

Accepted Answer

Partition the table by a date or timestamp column.. Partitioning the table by a date or timestamp column (Option B) reduces the amount of data scanned by BigQuery for queries that filter on that column, directly lowering query costs (pay-per-byte model). It also improves performance by pruning irrelevant partitions, making it a core cost-saving technique for ad-hoc analytical workloads.

Answer

Enable automatic schema detection to avoid manual schema definition.

Answer

Use flat-rate pricing with reserved slots.

Question 17

A team deployed the Terraform configuration shown in the exhibit. They observe that Cloud NAT is not translating traffic from the private subnet as expected. What is the most likely cause?

Accepted Answer

The Cloud Router is not in the same VPC network as the private subnet. Option A is correct because Cloud NAT requires a Cloud Router to be in the same VPC network as the subnet whose traffic needs translation. If the Cloud Router is in a different VPC network, the NAT gateway cannot establish the necessary BGP sessions or route traffic from the private subnet, causing NAT to fail silently.

Answer

The log filter is set to ERRORS_ONLY, which suppresses all logs

Answer

The NAT IP allocation is manual and no IPs were specified

Answer

The subnet is not included in the source_subnetwork_ip_ranges_to_nat list

Question 18

You are running a Kubernetes cluster in GKE with the default node pool configuration shown in the exhibit. Your application requires high disk I/O performance. You notice that the application is experiencing high latency for disk operations. What is the most likely cause?

Accepted Answer

The default node pool uses pd-standard disks, which have low IOPS.. The default node pool in GKE uses pd-standard (standard persistent disk) which provides lower IOPS compared to pd-ssd. For applications requiring high disk I/O performance, pd-standard disks become a bottleneck, causing high latency. Upgrading to pd-ssd or using local SSDs would resolve this issue.

Answer

Node auto-repair is causing disk contention.

Answer

The OAuth scopes restrict disk access, causing high latency.

Answer

The machine type n1-standard-2 does not have enough CPU.

Question 19

A company runs a batch processing workload on Compute Engine instances in a managed instance group (MIG). The job is CPU-intensive and takes approximately 4 hours to complete. The company wants to reduce costs without sacrificing performance. Which action should they take?

Accepted Answer

Use preemptible VMs for the MIG and implement a checkpointing mechanism to handle interruptions.. Preemptible VMs are significantly cheaper than standard VMs but can be terminated at any time. For a batch processing workload that is CPU-intensive and runs for 4 hours, using preemptible VMs in a MIG with a checkpointing mechanism allows the job to resume from the last saved state after an interruption, thus reducing costs without sacrificing performance.

Answer

Purchase committed use discounts for the instance type.

Answer

Change the machine series to a smaller machine type.

Answer

Provision additional reserved VMs to ensure capacity.

Question 20

An organization has deployed a multi-region Cloud Spanner instance for a global application. The application is experiencing high latency for read requests from a specific region. The team has verified that the application is using stale reads and the data distribution is even. What is the most likely cause of the high latency?

Accepted Answer

The Spanner instance does not have a read replica in a location close to the clients.. Option D is correct because Cloud Spanner uses a single global configuration with regional read replicas. If the instance does not have a read replica in the region where the clients are located, read requests must traverse the network to a replica in another region, causing higher latency. Even with stale reads, the physical distance to the nearest replica directly impacts read latency.

Answer

The number of read replicas in the region is insufficient to handle the read volume.

Answer

The Spanner instance has too few nodes, causing contention.

Answer

The application is using read-write transactions instead of read-only transactions.