Google PCA Practice Test 26 — 15 Questions

Question 1

A company runs a critical application on a Compute Engine instance. They want to ensure that the application remains available even if the instance crashes. Which two GCP features should they use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Instance template with automatic restart.. An instance template with automatic restart enables Compute Engine to automatically restart a VM instance if it crashes or is terminated due to a non-user-initiated failure. This feature is configured at the instance level and ensures that the application recovers quickly without manual intervention, improving availability for a single-instance workload.

Answer

Regular snapshots of the persistent disk.

Answer

A load balancer distributing traffic to a single instance.

Answer

A Cloud CDN to cache static content.

Question 2

A company is migrating its on-premises workloads to Google Cloud. They have strict compliance requirements that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage the lifecycle of these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct service because it provides centralized management of customer-managed encryption keys (CMEK) for Google Cloud services. It allows you to create, rotate, destroy, and set permissions on symmetric and asymmetric keys, and integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest with keys you control.

Answer

Secret Manager

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Cloud Hardware Security Module (Cloud HSM)

Question 3

A startup uses Cloud Functions for event-driven processing. They notice some functions are timing out. How to increase reliability without changing the business logic?

Accepted Answer

Enable retry on failure for the event-driven function. Enabling retry on failure for event-driven Cloud Functions allows the platform to automatically retry the invocation when a function times out or fails, without modifying the business logic. This leverages the built-in retry mechanism for background functions, which uses exponential backoff to handle transient failures and improve reliability.

Answer

Increase the function timeout to the maximum allowed

Answer

Use Cloud Tasks to decouple and retry synchronously

Answer

Refactor the function to reduce complexity

Question 4

Refer to the exhibit. A Cloud Function processes files uploaded to Cloud Storage. It usually completes within 2 minutes, but recently it has been timing out after 540 seconds. What is the most likely cause?

Accepted Answer

A user uploaded a file larger than the maximum allowed size for the function (e.g., 6 GB), causing the processing time to exceed the 540s timeout. Cloud Functions have a maximum execution timeout of 540 seconds (9 minutes). If a file larger than the function's memory and processing capacity is uploaded, the function may take longer than this hard limit to process it, resulting in a timeout. The exhibit indicates the function usually completes within 2 minutes, so a sudden spike to exactly 540 seconds strongly suggests the file size exceeded the function's ability to finish within the maximum allowed timeout.

Answer

The function's maximum timeout was set to 540 seconds, causing it to always take that long

Answer

The function's memory limit is too low, causing thrashing and slowdown

Answer

The function entered an infinite loop

Question 5

Which TWO are recommended practices for securing a Kubernetes Engine (GKE) cluster?

Accepted Answer

Enable Binary Authorization to ensure only signed container images are deployed.. Binary Authorization enforces that only container images signed by trusted authorities (e.g., during a CI/CD pipeline) can be deployed to the cluster. This integrates with Google Cloud's Attestation Authority and ensures supply chain security by verifying signatures against a policy before admission.

Answer

Disable HTTP load balancing to reduce attack surface.

Answer

Use the default Compute Engine service account for all GKE nodes.

Answer

Enable basic authentication for easier access management.

Question 6

You need to run a load test against a web application hosted on Compute Engine. Which tool is recommended for generating HTTP traffic and measuring performance?

Accepted Answer

Cloud Load Testing (based on Locust). Google Cloud's recommended load testing tool is the Cloud Load Testing tool (also known as Distributed Load Testing using Kubernetes), which can deploy Locust or other load generators. Alternatively, you can use Locust or Apache JMeter directly. The Cloud Load Testing solution is a ready-to-use option.

Answer

Stackdriver Monitoring (now Cloud Monitoring)

Answer

gcloud compute ssh to manually send requests

Answer

Cloud Shell's built-in load generator

Question 7

You are designing a disaster recovery plan for a critical application running on GKE. You need to back up the cluster's state and application data. Which TWO services should you use together? (Choose 2)

Accepted Answer

Velero (formerly Heptio Ark). Velero is the standard tool for backing up GKE clusters and can store backups in Cloud Storage. Cloud Storage provides durable and versioned storage for backup artifacts. Filestore is for file storage, not cluster backups; Cloud SQL is for databases; Pub/Sub is for messaging.

Answer

Pub/Sub

Answer

Cloud SQL

Answer

Filestore

Question 8

A company wants to connect their on-premises data center to Google Cloud with a dedicated private connection that provides 99.99% availability and supports up to 100 Gbps bandwidth. They have a colocation facility near a Google Cloud region. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct physical connections between on-premises and Google Cloud, offering 10 Gbps or 100 Gbps per circuit and supporting multiple VLANs. For high availability, two circuits are recommended. Partner Interconnect is limited to 10 Gbps and relies on a service provider. HA VPN is over the public internet. Direct Peering does not provide SLA and is not recommended for production.

Answer

Partner Interconnect

Answer

Direct Peering

Answer

HA VPN

Question 9

An engineer needs to create a custom dashboard in Cloud Monitoring to track the 99th percentile latency of their application over the last 7 days. Which type of metric should they use?

Accepted Answer

Distribution metric. Cloud Monitoring supports metric types: gauge, delta, and cumulative. Distribution metrics can be used to calculate percentiles. The 99th percentile latency is typically captured as a distribution metric.

Answer

Delta metric

Answer

Cumulative metric

Answer

Gauge metric

Question 10

A company runs a critical application on GKE with etcd for configuration storage. They want to back up etcd data for disaster recovery. Which tool should they use?

Accepted Answer

Velero. Velero (formerly Heptio Ark) is an open-source tool for backing up and restoring Kubernetes resources, including etcd snapshots. gcloud container clusters describe does not back up, Backup for GKE is a managed service but not specifically for etcd, and etcdctl is a command-line tool for etcd but is not typically used for automated backups in GKE.

Answer

gcloud container clusters describe

Answer

Backup for GKE

Answer

etcdctl

Question 11

A company needs to retain object versions in Cloud Storage for 90 days to protect against accidental deletion or modification. After 90 days, versions should be deleted. What feature should they enable?

Accepted Answer

Object lifecycle management with a rule to delete versions after 90 days. Object versioning in Cloud Storage keeps multiple versions of an object. Object lifecycle management can be configured to delete versions older than a specified number of days.

Answer

Object versioning only

Answer

Retention policy

Answer

Object holds

Question 12

A company runs a multi-tier application on Google Cloud: a frontend on App Engine Standard, a backend on Cloud Run, and a Cloud SQL database. The application experiences intermittent 500 errors when users submit forms. The errors correlate with high CPU usage on the Cloud SQL instance (db-n1-standard-2, 7.5 GB memory). The Cloud Run service has a concurrency setting of 80 and a maximum of 10 instances. The App Engine service uses automatic scaling. The team has verified that the application code is not the issue. They suspect the database is hitting connection limits. Current max_connections on Cloud SQL is 250. The Cloud Run service uses a connection pool of 10 connections per instance. The App Engine service uses a connection pool of 5 connections per instance. They also have a few batch jobs that run occasionally, using up to 10 connections. The team wants to resolve the errors with minimal cost and complexity. Which course of action should they take?

Accepted Answer

Increase the max_connections parameter on Cloud SQL to 500.. The intermittent 500 errors are caused by the Cloud SQL instance hitting its max_connections limit of 250. With Cloud Run using 10 connections per instance and up to 10 instances (100 connections), App Engine using 5 connections per instance (unknown instance count but likely significant), and batch jobs using up to 10 connections, the total can easily exceed 250. Increasing max_connections to 500 directly addresses the connection limit without changing instance size or scaling behavior, which is the simplest and most cost-effective fix.

Answer

Increase the maximum number of Cloud Run instances to 20 to handle more requests.

Answer

Upgrade the Cloud SQL instance to db-n1-standard-4 (15 GB memory) to handle more connections.

Answer

Reduce the concurrency setting on Cloud Run from 80 to 40.

Question 13

A developer needs to view the last 100 lines of logs from a specific Compute Engine instance in real time to debug an application issue. Which command should they use?

Accepted Answer

gcloud logging read "resource.type=gce_instance AND resource.labels.instance_id=INSTANCE_ID" --limit=100 --freshness=1h. The gcloud logging read command can filter logs and tail them with the --freshness flag. gcloud compute instances get-serial-port-output retrieves serial console output, not application logs. gcloud app logs read is for App Engine. gcloud beta logging tail streams logs in real time.

Answer

gcloud beta logging tail

Answer

gcloud app logs read --limit=100

Answer

gcloud compute instances get-serial-port-output INSTANCE_NAME

Question 14

Your organization wants to use Cloud SQL for a MySQL database with automatic failover in the event of a zone outage. Which configuration should you choose?

Accepted Answer

Create a regional Cloud SQL instance (high availability) with a primary and standby zone. Cloud SQL provides high availability by creating a primary instance in one zone and a standby instance (failover replica) in another zone within the same region. Automatic failover is enabled when you create a regional Cloud SQL instance. A read replica does not provide automatic failover.

Answer

Set up Cloud SQL with external replication to a VM in another zone

Answer

Create a Cloud SQL instance with a cross-region read replica

Answer

Create a single-zone Cloud SQL instance with automatic backups enabled

Question 15

A company uses Cloud Storage to store backup files. They need to retain backups for 7 years and must be able to recover deleted or overwritten files within that period. Which Cloud Storage feature should they enable?

Accepted Answer

Object versioning. Object versioning keeps multiple versions of an object, allowing recovery from deletion or overwrite. Object retention policies prevent deletion but do not allow recovery of overwritten versions. Lifecycle management is for automation. Uniform bucket-level access is for permissions.

Answer

Object retention policy

Answer

Lifecycle management

Answer

Uniform bucket-level access