Google PCA Practice Test 27 — 15 Questions

Question 1

A company runs a latency-sensitive web application on Compute Engine with a managed instance group (MIG) behind an HTTP load balancer. They want to reduce latency for users in Europe and Asia. Which THREE actions should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Cloud CDN to cache static content. Option B is correct because enabling Cloud CDN on the HTTP(S) load balancer caches static content at Google's globally distributed edge points of presence, serving users in Europe and Asia from nearby locations and reducing round-trip latency. Option C is correct because a global external HTTP(S) Load Balancer uses a single global anycast IP and routes each user to the closest healthy backend region, which is the standard architecture for lowering latency for a geographically dispersed audience. Option E is correct because deploying managed instance groups in multiple regions such as europe-west1 and asia-east1 places application capacity close to European and Asian users, so requests terminate in-region instead of crossing the globe. Option A is not appropriate because separate regional external load balancers would fragment traffic across multiple IPs and lack the global anycast routing and single-IP simplicity of a global load balancer. Option D is not appropriate because preemptible VMs are a cost optimization, not a latency optimization, and their preemption can hurt the availability of a latency-sensitive application.

Answer

Use a regional external load balancer for each region

Answer

Use preemptible VMs to reduce costs in non-primary regions

Question 2

A company runs a microservices application on Google Kubernetes Engine (GKE). Each service is deployed as a Deployment with resource requests and limits. After deploying a new version of a service, the pods start crashing with OOMKilled. The team increased the memory limits in the Deployment manifest, but the pods still crash after a few minutes. The cluster has cluster autoscaling enabled. The node pool has sufficient capacity. What is the most likely cause of the issue?

Accepted Answer

The application has a memory leak. The pods are crashing with OOMKilled even after increasing memory limits, and the node pool has sufficient capacity. This indicates the application itself has a memory leak, where memory usage grows unbounded over time until it exceeds the new limit, causing the OOMKiller to terminate the pod. Increasing limits only delays the crash if the leak persists.

Answer

The Horizontal Pod Autoscaler is configured with a wrong target metric

Answer

The cluster autoscaler is not scaling up quickly enough

Answer

The pods are hitting the node's ephemeral storage limit

Question 3

A company wants to deploy a microservice on Cloud Run that requires high throughput and low latency. The service processes requests that can spike unpredictably. The team wants to minimize cold starts and ensure availability during traffic bursts. Which combination of Cloud Run settings should they configure?

Accepted Answer

min-instances = 1, max-instances = 100, concurrency = 80. To minimize cold starts, the team must keep at least one warm instance, so min-instances must be 1 (not 0). To handle unpredictable spikes, max-instances must be high enough to scale out, so 100 is appropriate. Concurrency of 80 allows each instance to handle many simultaneous requests, maximizing throughput per instance and reducing the number of instances needed. Only option D combines a warm minimum, a high ceiling, and high concurrency.

Answer

min-instances = 1, max-instances = 1, concurrency = 80

Answer

min-instances = 0, max-instances = 100, concurrency = 1

Answer

min-instances = 0, max-instances = 10, concurrency = 80

Question 4

A company runs a critical application on Compute Engine instances. They want to automatically patch the operating system on a weekly schedule to meet compliance requirements. Which Google Cloud service should they use?

Accepted Answer

OS Config. OS Config, part of VM Manager, provides patch management capabilities including scheduled patching and compliance reporting.

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Answer

Cloud Build

Question 5

A company is designing a data processing pipeline in Google Cloud that must be HIPAA compliant. Which three security features should they implement? (Choose three.)

Accepted Answer

Encrypt data in transit using TLS. Encrypting data in transit using TLS is a mandatory security control for HIPAA compliance because it protects electronic protected health information (ePHI) from interception during transmission over networks. TLS 1.2 or higher ensures that data moving between clients, services, and Google Cloud endpoints is encrypted, meeting the HIPAA Security Rule requirement for integrity and confidentiality of ePHI in transit.

Answer

Enable Data Loss Prevention (DLP) for data classification

Answer

Use Cloud CDN for faster delivery

Question 6

A company has a Cloud Run service that processes high-throughput requests. They want to reduce latency by keeping a baseline of warm instances always ready to handle traffic. Which Cloud Run configuration parameters should they adjust?

Accepted Answer

Set min-instances to 10 and CPU to always-on. Setting min-instances to a value greater than zero (e.g., 10) ensures that Cloud Run keeps that many instances warm and ready at all times, eliminating cold-start latency for the baseline traffic. Additionally, setting CPU to 'always-on' (also called 'CPU always allocated') prevents the CPU from being throttled to near-zero when no requests are being processed, which is critical for background work and for maintaining warm instances that can respond immediately. Together, these two parameters directly address the requirement to keep a baseline of warm instances and reduce latency.

Answer

Set min-instances to 0 and max-instances to 100

Answer

Set max-instances to a high value and concurrency to 1

Answer

Set max-instances to 0 (unlimited) and concurrency to 80

Question 7

A user wants to store a database password that will be used by a Compute Engine instance. What is the most secure and manageable approach?

Accepted Answer

Use Secret Manager and grant the instance's service account access to the secret. Secret Manager is the most secure and manageable approach because it provides encrypted storage, automatic rotation, and fine-grained access control via IAM. By granting the Compute Engine instance's service account access to the secret, the password is never exposed in plaintext metadata, logs, or disk files, and access can be audited and revoked independently of the instance lifecycle.

Answer

Set the password as an environment variable in instance metadata

Answer

Store the password in Cloud Storage bucket metadata

Answer

Store the password in a file on the instance's boot disk

Question 8

A startup wants to deploy a containerized application with minimal operational overhead. They expect variable traffic. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it is a fully managed serverless compute platform that automatically scales from zero based on traffic, charges only for resources used during request processing, and eliminates all infrastructure management. This aligns perfectly with the startup's requirement for minimal operational overhead and handling variable traffic patterns without provisioning or scaling concerns.

Answer

App Engine Flexible Environment

Answer

Compute Engine single VM

Answer

Google Kubernetes Engine (GKE)

Question 9

Refer to the exhibit. A subnet was created with the `--enable-private-ip-google-access` flag. What does this flag enable for instances in this subnet?

Accepted Answer

Instances can access Google APIs and services without requiring an external IP address.. The `--enable-private-ip-google-access` flag allows VM instances in a subnet to reach Google APIs and services (such as Cloud Storage, BigQuery, and Cloud Pub/Sub) using only their internal (private) IP addresses, without needing an external IP address. This works by routing traffic through Google's internal network to the Google Front End (GFE), bypassing the public internet.

Answer

Instances can use direct peering to connect to on-premises networks.

Answer

Instances automatically receive internal DNS names for Google services.

Answer

Instances can route traffic to the internet through a Cloud NAT gateway.

Question 10

A company uses Google Cloud Armor to protect their HTTP load balancer from OWASP Top 10 attacks. After deploying a security policy with pre-configured WAF rules, they notice that some legitimate user requests are being blocked because they match a rule incorrectly. The security team wants to fine-tune the rules to reduce false positives while maintaining strong protection. They also want to evaluate the impact of changes before enforcing them. What should they do?

Accepted Answer

Set the WAF rules to 'preview' mode to test their impact without blocking traffic, then adjust thresholds or exclusions based on logs.. Google Cloud Armor's 'preview' mode allows you to apply a security policy to a backend service or load balancer without actually blocking traffic. Instead, all matched requests are logged, enabling you to analyze false positives in the logs before enforcing the rules. This approach lets you fine-tune thresholds, add exclusions, or adjust rule priorities based on real traffic patterns, reducing false positives while maintaining strong protection.

Answer

Disable the WAF rules entirely and implement IP-based allowlists.

Answer

Add a higher priority allow rule to permit the traffic that is being incorrectly blocked.

Answer

Remove the WAF rules and rely solely on rate limiting to protect the application.

Question 11

A company hosts a web application on Google Kubernetes Engine (GKE) and wants to protect against SQL injection attacks. Which service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities that can inspect HTTP/HTTPS traffic and block SQL injection attempts using preconfigured rules (e.g., the OWASP Top 10 rule set). It integrates directly with GKE via HTTP(S) Load Balancing, allowing you to enforce security policies at the edge before requests reach your application.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Audit Logs

Answer

Container Analysis

Question 12

A company is planning to deploy a global web application on Google Cloud. They expect low latency for users worldwide and need to serve static content (images, CSS) as well as dynamic API responses. Which architecture should they use?

Accepted Answer

Use Cloud CDN in front of an external HTTPS Load Balancer with backend services in multiple regions.. Cloud CDN in front of an external HTTPS Load Balancer with backend services in multiple regions is correct because it provides global anycast IP termination, low-latency content delivery via Google's edge cache for static content, and dynamic API requests are forwarded to the nearest healthy backend in the closest region. This architecture meets both the low-latency requirement for users worldwide and the need to serve both static and dynamic content efficiently.

Answer

Use Cloud NAT to allow egress traffic from instances and distribute static content via a shared VPC.

Answer

Use Cloud DNS with geo-routing to direct users to the closest regional Cloud Run service.

Answer

Use VPC Network Peering to connect multiple regional VPCs and serve content from a central location.

Question 13

A developer needs to programmatically create and manage Compute Engine instances. Which Google Cloud service should they use to authenticate and authorize service accounts?

Accepted Answer

Cloud IAM. Cloud IAM is the correct service because it provides the identity and access management framework for authenticating and authorizing service accounts. When a developer creates Compute Engine instances, they must attach a service account and grant IAM roles (e.g., roles/compute.instanceAdmin) to define what actions that service account can perform. Cloud IAM handles the authentication via OAuth 2.0 tokens and authorization via role-based access control (RBAC), making it the foundational service for managing service account permissions.

Answer

Cloud Audit Logs

Answer

Cloud Key Management Service (KMS)

Answer

Cloud Scheduler

Question 14

A company uses Cloud Build to deploy a Java application to Artifact Registry. They want to automatically trigger a build only when changes are pushed to the 'main' branch in their Cloud Source Repository. Which configuration should they use?

Accepted Answer

Create a Cloud Build trigger with an included branch filter set to '^main$'. Cloud Build triggers natively support branch filtering via the `included` or `ignored` branch filters. Setting the included branch filter to the regex `^main$` ensures the trigger only fires when a push event occurs on the `main` branch. This is the intended, serverless, and declarative way to achieve branch-specific builds without custom code or polling. The `^` and `$` anchors guarantee an exact match, preventing accidental triggers on branches like `feature/main` or `main-dev`.

Answer

Configure a Cloud Function that listens for Pub/Sub messages from Cloud Source Repo and calls Cloud Build API

Answer

Create a Cloud Scheduler job that runs a Pub/Sub push to Cloud Build every hour

Answer

Use a Cloud Build build step that checks the branch name and aborts if not main

Question 15

A company is deploying a multi-tenant SaaS application on GKE. Each tenant's data must be isolated at the network level. They want to use a single GKE cluster but ensure that pods from different tenants cannot communicate with each other. Which GCP feature should they use?

Accepted Answer

Kubernetes Network Policies. Kubernetes Network Policies are the native Kubernetes feature that allows you to define rules controlling traffic between pods. By creating NetworkPolicy resources that select pods based on labels (e.g., tenant labels), you can isolate tenants so that pods from different tenants cannot communicate with each other. This provides network-level isolation within a single GKE cluster.

Answer

Istio service mesh

Answer

VPC Service Controls

Answer

GKE Sandbox