Google PCA Practice Test 26 — 15 Questions

Question 1

A company wants to use Cloud Deploy to automate deployments to GKE. They need to configure an approval gate that requires manual approval before promoting a release to a production cluster. Where is this approval gate defined?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the delivery pipeline YAML under the 'target' definition. In Google Cloud Deploy, approval gates are defined within the delivery pipeline configuration, specifically under the target definition. The target represents a deployment environment (e.g., production cluster) and can include a 'requireApproval' field to enforce manual approval before any release is promoted to that target. This ensures that promotions to sensitive environments are gated by human intervention.

Answer

In the Cloud Scheduler job

Answer

In the GKE cluster as a constraint

Answer

In the cloudbuild.yaml file

Question 2

A team is running a GKE cluster with a workload that has variable CPU and memory usage. They want to automatically adjust pod resource requests and limits based on historical usage to improve resource efficiency. Which feature should they use?

Accepted Answer

Vertical Pod Autoscaler (VPA). The Vertical Pod Autoscaler (VPA) automatically adjusts pod resource requests and limits based on historical usage, right-sizing workloads to improve resource efficiency. It observes CPU and memory consumption over time and updates the pod's resource specifications, either by restarting pods (Recreate mode) or, in newer versions, by in-place updates. This directly matches the requirement to adjust requests and limits based on historical usage.

Answer

PodDisruptionBudget (PDB)

Answer

Horizontal Pod Autoscaler (HPA)

Answer

Cluster Autoscaler

Question 3

A company has a fleet of Compute Engine instances that need to access a Cloud Storage bucket. The security team requires that only instances in specific VPC networks can access the bucket, and that the data is encrypted in transit. How can this be achieved?

Accepted Answer

Create a VPC Service Controls perimeter with access levels, and require HTTPS for the bucket.. VPC Service Controls allows you to define a security perimeter around Cloud Storage, restricting access to only requests originating from specific VPC networks. By configuring an access level that requires HTTPS, you enforce encryption in transit, meeting both the network restriction and data-in-transit encryption requirements.

Answer

Use a Cloud Storage bucket with encryption at rest using CSEK.

Answer

Use Cloud Armor with IP allowlists and enable TLS for the bucket.

Answer

Use a Cloud Storage bucket with encryption at rest using CMEK.

Question 4

Which THREE are best practices for designing a highly available application on Compute Engine?

Accepted Answer

Use managed instance groups with autoscaling. Option C is correct because a managed instance group (MIG) with autoscaling automatically maintains the desired number of healthy VM instances and replaces failed ones, which is fundamental to high availability on Compute Engine. Option D is correct because an external load balancer with health checks only routes traffic to healthy backends and removes unhealthy instances from rotation, preventing users from hitting failed VMs. Option E is correct because distributing instances across multiple zones protects the application from a single-zone failure, since zonal outages do not affect instances in other zones within the same region. Option A is not appropriate because local SSDs are ephemeral and tied to a single VM, so they cannot store durable stateful data for a highly available design. Option B is not appropriate because a single large machine type creates a single point of failure and cannot provide redundancy or fault tolerance.

Answer

Use local SSDs for stateful data

Answer

Use a single large machine type

Question 5

A company wants to migrate a large on-premises relational database to Cloud SQL for PostgreSQL with minimal downtime. They need to ensure data consistency during the migration. Which THREE steps should they take?

Accepted Answer

Set up a VPN or Cloud Interconnect between on-premises and GCP. Option A is correct because a reliable, low-latency private network path via Cloud VPN or Cloud Interconnect is required for the initial bulk data transfer and for Database Migration Service's continuous replication to keep the on-premises source and Cloud SQL in sync with minimal downtime. Option D is correct because Database Migration Service (DMS) for PostgreSQL supports continuous replication (change data capture) from the on-premises source to Cloud SQL, which is the key mechanism for minimizing downtime and maintaining data consistency until cutover. Option E is correct because performing an initial export/import (for example, using pg_dump and pg_restore) seeds Cloud SQL with the existing dataset before continuous replication begins, so DMS only has to apply ongoing changes rather than the entire database. Option B is not appropriate because Cloud SQL read replicas replicate from a Cloud SQL primary, not from an external on-premises PostgreSQL source, so they cannot serve as the migration replication mechanism. Option C is not appropriate because switching traffic immediately after the initial import would cause data written to the source during and after the import to be lost, breaking consistency; traffic should only be cut over after replication has caught up and the systems are synchronized.

Answer

Create a read replica of the source database in Cloud SQL

Answer

Switch traffic to Cloud SQL immediately after the initial import

Question 6

A multinational e-commerce company needs a globally distributed database that provides strong consistency and transactional support for order processing. Which Google Cloud database service should they use?

Accepted Answer

Cloud Spanner. Cloud Spanner is the correct choice because it is a globally distributed, horizontally scalable relational database service that provides strong consistency and full ACID transactional support across regions. Unlike other Google Cloud databases, Spanner uses synchronous replication and the TrueTime API to guarantee external consistency, making it ideal for order processing systems that require both global scale and transactional integrity.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 7

A team is deploying a stateful application on GKE. They want to ensure that the application's pods are distributed across different zones for high availability and that during cluster upgrades, at least one pod remains available. Which THREE features should they configure?

Accepted Answer

Pod topology spread constraints. Option A (Pod topology spread constraints) is correct because topologySpreadConstraints with topologyKey set to topology.kubernetes.io/zone (and a whenUnsatisfiable policy such as DoNotSchedule or ScheduleAnyway) explicitly spreads pods evenly across zones, which is exactly what the team needs for zonal high availability. Option B (StatefulSet) is correct because a stateful application requires stable network identities, ordered deployment/scaling, and persistent volume claims per replica, all of which StatefulSet provides via its governing Service and volumeClaimTemplates. Option E (PodDisruptionBudget) is correct because a PDB with minAvailable: 1 (or maxUnavailable: 0) ensures that during voluntary disruptions such as node drains in a cluster upgrade, at least one pod remains running. Option C (Cluster autoscaler) is not correct because it only adds or removes nodes based on pending pods and resource pressure; it does not control zonal pod distribution or guarantee availability during upgrades. Option D (Horizontal Pod Autoscaler) is not correct because it scales replica counts based on metrics like CPU or custom metrics, which addresses load-based scaling rather than zonal spreading or upgrade-time availability guarantees.

Answer

Cluster autoscaler

Answer

Horizontal Pod Autoscaler

Question 8

A company wants to connect their on-premises network to Google Cloud with a dedicated, high-bandwidth, low-latency connection that supports Service Level Agreements (SLAs) up to 99.99% availability. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google Cloud, offering high bandwidth (up to 100 Gbps per link), low latency, and support for SLAs up to 99.99% availability. This option meets the requirement for a dedicated, high-bandwidth, low-latency connection with the highest SLA, unlike VPN-based or partner-mediated solutions.

Answer

Classic VPN

Answer

Partner Interconnect

Answer

Cloud VPN (IPsec VPN)

Question 9

A company is migrating its on-premises data center to Google Cloud. They need a dedicated, low-latency, high-bandwidth connection between their on-premises network and VPC. They anticipate consistent traffic above 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection with bandwidth up to 100 Gbps per circuit, ideal for high-throughput, low-latency requirements. Partner Interconnect relies on a service provider and typically offers lower bandwidth. HA VPN is over the public internet and may not meet high bandwidth or low latency. Classic VPN is a single tunnel without high availability.

Answer

Partner Interconnect

Answer

HA VPN

Answer

Classic VPN

Question 10

A company wants to reduce costs for a batch analytics job that runs nightly for 4 hours on Compute Engine VMs. The job is fault-tolerant and can handle instance restarts. Which Compute Engine VM pricing model is MOST cost-effective?

Accepted Answer

Preemptible VMs. Preemptible VMs offer the lowest cost (up to 80% discount) and are ideal for fault-tolerant, short-lived batch workloads that can handle interruptions. Sustained use discounts apply automatically but require running a VM for at least 25% of a month. Committed use discounts require a 1- or 3-year commitment and are not as flexible for a short nightly job.

Answer

3-year committed use discount (CUD)

Answer

1-year committed use discount (CUD)

Answer

Sustained use discounts

Question 11

An engineer needs to troubleshoot a production issue on a Compute Engine instance. They suspect the instance is running out of memory. Which THREE actions should they take to diagnose the problem? (Choose THREE.)

Accepted Answer

SSH into the instance and run 'free -m' to check memory usage. Option A is correct because running 'free -m' over SSH directly reports the instance's current RAM and swap usage in megabytes, immediately confirming whether memory is exhausted. Option B is correct because when the Linux kernel OOM killer terminates processes, it logs messages such as 'Out of memory: Killed process' to the kernel log, which is captured by the Cloud Logging agent and searchable in Logs Explorer. Option E is correct because the Cloud Monitoring agent (or Ops Agent) publishes the 'memory/utilization' metric, letting the engineer review historical memory trends and correlate spikes with the incident. Option C is not a diagnostic action but a remediation that changes the machine type and requires a stop/start, so it does not help identify the cause. Option D is also not diagnostic; creating a boot disk snapshot only preserves disk state and does not reveal memory consumption.

Answer

Increase the instance's memory by changing the machine type

Answer

Create a snapshot of the boot disk

Question 12

A web application running on Compute Engine behind a global HTTP(S) load balancer experiences high latency during traffic spikes. Which quick fix would best address this issue without changing the architecture?

Accepted Answer

Configure managed instance group autoscaling to add more instances.. Managed instance group (MIG) autoscaling dynamically adds more instances when CPU utilization or other metrics exceed a threshold, directly absorbing the increased traffic during spikes. This is the quickest fix because it requires no architectural changes—just configuring autoscaling parameters on the existing MIG. By scaling out horizontally, the load balancer can distribute requests across more backends, reducing per-instance load and latency.

Answer

Enable Cloud CDN on the load balancer.

Answer

Switch to a regional load balancer to reduce latency.

Answer

Increase the machine type of the backend instances.

Question 13

Which THREE are required to configure Workload Identity for a GKE cluster? (Choose 3)

Accepted Answer

Create a Google Cloud service account. A Google Cloud service account (GSA) is required to authenticate to Google Cloud APIs from within GKE. Workload Identity maps a Kubernetes service account (KSA) to a GSA, allowing pods to inherit the GSA's IAM permissions without managing static keys. The GSA must be created first to define the identity that workloads will assume.

Answer

Bind the Kubernetes service account to the Google Cloud service account using a Kubernetes RoleBinding

Answer

Use a node pool that has Workload Identity enabled

Question 14

A company is planning to migrate a large on-premises Oracle database (10 TB) to Cloud SQL for PostgreSQL. They need to minimise downtime and ensure data integrity. Which TWO services or tools should they use? (Choose TWO.)

Accepted Answer

Database Migration Service (DMS). Database Migration Service (DMS) supports online migration from Oracle to Cloud SQL for PostgreSQL with minimal downtime by using continuous replication. Cloud SQL Auth Proxy is a tool for secure client connections to Cloud SQL instances; it is not required for the migration process itself. Cloud Dataflow is for data processing, Cloud Scheduler for job scheduling, and Migrate for Compute Engine for VM migration.

Answer

Migrate for Compute Engine

Answer

Cloud Dataflow

Answer

Cloud Scheduler

Answer

Cloud SQL Auth Proxy

Question 15

A company is migrating its on-premises Oracle database to Cloud SQL for PostgreSQL. The database team wants to minimize downtime during migration. Which approach should they use?

Accepted Answer

Use Database Migration Service for PostgreSQL with continuous migration from Oracle via Homogeneous Migration.. Database Migration Service (DMS) for PostgreSQL with continuous migration is the correct approach because it supports ongoing change data capture (CDC) from Oracle to Cloud SQL for PostgreSQL, enabling near-zero downtime. DMS handles schema conversion and data replication continuously, allowing the target to stay synchronized until a cutover, which minimizes downtime compared to batch methods.

Answer

Set up Oracle GoldenGate to replicate to Cloud SQL.

Answer

Take a physical backup of Oracle and restore to Cloud SQL.

Answer

Export the database as a dump file, upload to Cloud Storage, and import into Cloud SQL.