Google PCA Practice Test 28 — 15 Questions

Question 1

A company stores sensitive customer data in Cloud Storage buckets. They want to ensure that access to these buckets is only allowed from within their VPC network. Which configuration should they use?

Accepted Answer

VPC Service Controls with a service perimeter. D is correct because VPC Service Controls (VPC-SC) allow you to define a service perimeter that restricts access to Google Cloud Storage (and other managed services) to only requests originating from a specified VPC network. This ensures that data exfiltration and unauthorized access from outside the VPC are blocked, even if the bucket is publicly accessible or IAM allows broader access.

Answer

Bucket IAM policies with condition on service account

Answer

Cloud Armor WAF rules

Answer

Private Google Access for on-premises

Question 2

An organization has multiple projects in Google Cloud and wants to centralize logging and monitoring for all projects. They need to aggregate logs from all projects into a single project for analysis. Which approach should they use?

Accepted Answer

Create a logs sink in each project that exports logs to a BigQuery dataset in the central project.. Google Cloud's logs sink feature allows you to route logs from multiple source projects to a centralized BigQuery dataset in a single destination project. This approach aggregates logs efficiently without requiring agents or manual import steps, and it supports real-time log export for analysis.

Answer

Export logs from each project to a Cloud Storage bucket and then import them into BigQuery.

Answer

Enable Cloud Audit Logs for all projects and view them from the central project.

Answer

Install the Stackdriver agent on all VMs and point them to the central project.

Question 3

An organization needs to comply with FedRAMP requirements and restrict data storage to specific regions. They also need to audit all admin activities and data access. Which three components should they implement? (Choose three.)

Accepted Answer

Data Access audit logs. Assured Workloads (E) is correct because it is the Google Cloud service specifically designed to enforce regulatory compliance frameworks such as FedRAMP and to restrict data storage and processing to specific regions through its compliance controls. Admin Activity audit logs (D) are correct because they record all administrative and configuration changes made to resources, which is required to audit all admin activities. Data Access audit logs (B) are correct because they capture read and write operations on user data, satisfying the requirement to audit all data access. VPC Service Controls (A) is not selected because, while it provides service perimeter security to mitigate data exfiltration, it does not itself enforce FedRAMP compliance or regional data residency. Cloud Armor (C) is not selected because it is a WAF/DDoS protection service for external HTTP(S) load balancers and does not address compliance, data residency, or audit logging requirements.

Answer

VPC Service Controls

Answer

Cloud Armor

Question 4

Your organization is implementing a Disaster Recovery plan for a critical database. Which THREE components are essential for a robust DR strategy? (Choose 3)

Accepted Answer

Automated failover process to switch traffic to the DR region.. An automated failover process is essential for minimizing Recovery Time Objective (RTO) in a Disaster Recovery strategy. Without automation, manual intervention introduces delays and risks of human error, which can extend downtime significantly. In cloud or on-premises environments, automated failover typically relies on health checks, DNS updates, or traffic manager rules to seamlessly redirect traffic to the DR region when the primary fails.

Answer

A single global load balancer for both regions.

Answer

Using a single zone for the primary region.

Question 5

Which THREE options are valid strategies for disaster recovery (DR) in Google Cloud?

Accepted Answer

Deploy a mirrored environment in another region and use Traffic Director to fail over.. Option B is correct because deploying a mirrored environment in a second region and using Traffic Director for global load balancing and failover provides true cross-region DR, ensuring workloads survive a full regional outage. Option D is correct because a Cloud Storage bucket in a different region with Object Versioning enabled gives durable, geographically separated copies of data and protects against accidental deletion or overwrite, which is a valid DR strategy. Option E is correct because a Cloud SQL cross-region replica can be promoted to a standalone primary during a regional failure, restoring database availability in another region. Option A is not a valid DR strategy because snapshots stored in the same region are lost if that region fails, so they do not provide disaster recovery. Option C is not a DR strategy because Cloud CDN caching static content from multiple origins improves performance and availability but does not by itself recover from a regional disaster or protect stateful data.

Answer

Store hourly snapshots of Compute Engine disks in the same region.

Answer

Enable Cloud CDN to cache static content from multiple origins.

Question 6

A developer wants to deploy a containerized web application on Google Cloud that can scale to zero when not in use and charges only for resources consumed during request processing. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero when there is no traffic and bills only for CPU/memory consumed during request processing (and optionally during background work). It runs any containerized HTTP application, making it the exact match for the stated requirements. GKE and Compute Engine do not scale to zero, and App Engine Flexible keeps at least one instance running.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Flexible Environment

Answer

Compute Engine instance group

Question 7

A financial services company is migrating a sensitive customer data application to Google Cloud. The application runs on Compute Engine VMs in a VPC. The security team requires that all data at rest in Cloud Storage and BigQuery must be encrypted with customer-managed encryption keys (CMEK). Additionally, the keys must be stored in a different project than the data, and access to the keys must be audited. The operations team has set up a CMEK key in Cloud KMS in a separate project, assigned the Cloud KMS CryptoKey Encrypter/Decrypter role to the data project's Compute Engine service account, and enabled Cloud Storage and BigQuery to use CMEK. However, when the application tries to read from Cloud Storage, it fails with 'Access Denied.' The Cloud KMS key is in project 'kms-proj' and the data is in project 'data-proj'. What is the most likely cause?

Accepted Answer

The Cloud Storage service agent in 'data-proj' does not have the Cloud KMS CryptoKey Encrypter/Decrypter role.. Cloud Storage uses a Google-managed service agent (not the Compute Engine service account) to interact with CMEK keys. When Cloud Storage is configured to use CMEK, its service agent in the data project must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the key in the KMS project. Without this permission, Cloud Storage cannot decrypt the key to access the data, resulting in an 'Access Denied' error even though the VM's service account has the correct role.

Answer

The Compute Engine service account used by the VM does not have the Cloud KMS Decrypter role.

Answer

The VPC firewall rules are blocking egress to Cloud KMS.

Answer

The Cloud KMS key has been disabled due to an Organization Policy.

Question 8

A team uses Cloud CDN to cache static assets. They update assets by deploying new versions with new URLs. However, sometimes they need to invalidate the cache for a critical fix immediately without changing the URL. What should they do?

Accepted Answer

Use cache invalidation to remove the cached objects. Cache invalidation is the correct mechanism when content must be refreshed immediately without changing the URL. Cloud CDN supports explicit invalidation requests that purge cached objects from edge locations, forcing subsequent requests to fetch fresh content from the origin. This is the only option that removes already-cached content on demand rather than waiting for TTL expiry or relying on URL changes.

Answer

Increase the TTL to max

Answer

Change the URL to a new version

Answer

Set a short TTL (e.g., 1 minute)

Question 9

A company wants to automatically move data from Cloud Storage Standard to Nearline after 30 days and to Archive after 90 days. Which approach should they use?

Accepted Answer

Set up a Cloud Storage lifecycle policy with rules to transition to Nearline after 30 days and to Archive after 90 days. Cloud Storage lifecycle policies are the native, automated way to transition objects between storage classes based on age. A single lifecycle rule can specify a transition to Nearline after 30 days and another transition to Archive after 90 days, applied to the bucket or specific prefixes. This eliminates the need for custom code and ensures cost optimization automatically.

Answer

Write a custom script using Cloud Functions triggered by Pub/Sub to move objects

Answer

Use Object Versioning to automatically change storage class

Answer

Enable Requester Pays on the bucket to reduce storage costs

Question 10

A company runs a global e-commerce site on GKE. They want to ensure disaster recovery with multi-region deployment. What is the best practice for configuring GKE clusters?

Accepted Answer

Deploy separate regional clusters in two or more regions.. For disaster recovery with a multi-region deployment, the best practice is to deploy separate regional clusters in two or more regions. This ensures that if an entire region fails, traffic can be redirected to the other region's cluster, providing true geographic redundancy. A single cluster, whether zonal or regional, cannot survive a regional outage because it is bound to a single control plane location.

Answer

Use a single zonal cluster with node auto-repair.

Answer

Deploy a single cluster with multi-master setup.

Answer

Use a single regional cluster with multiple zones.

Question 11

A company wants to migrate an on-premises Oracle database to Google Cloud. They need high availability and want to minimize application changes. Which service should they use?

Accepted Answer

Bare Metal Solution. Bare Metal Solution is correct because it provides dedicated physical servers for Oracle workloads, enabling high availability through Oracle RAC or Data Guard while preserving the existing Oracle database architecture. This minimizes application changes since the database remains Oracle-native, unlike managed services that require migration to a different database engine.

Answer

Cloud SQL for MySQL

Answer

Cloud Spanner

Answer

Compute Engine with Oracle license

Question 12

You are investigating a Vertex AI Workbench instance (instance-2) that is showing UNHEALTHY status. Based on the exhibit, what is the most likely cause of the issue?

Accepted Answer

The container image gcr.io/my-project/my-image:latest does not exist, or the service account used by the Workbench instance does not have storage.objectViewer access to the container registry.. The UNHEALTHY status in Vertex AI Workbench typically occurs when the instance fails to start its container. Option A is correct because the most likely cause is that the specified container image (gcr.io/my-project/my-image:latest) does not exist in Container Registry, or the service account attached to the instance lacks the storage.objectViewer role on the registry bucket. Without this permission, the instance cannot pull the image, leading to a container creation failure and an UNHEALTHY state. Options B, C, and D are less likely given the focus on the container image in the exhibit.

Answer

The container registry endpoint is blocked by a firewall rule that does not allow egress to gcr.io.

Answer

The instance's underlying Compute Engine resources are exhausted, causing the container creation to timeout.

Answer

The Workbench instance is using an outdated custom image that is not compatible with the latest runtime version.

Question 13

A company is designing a data pipeline to ingest streaming data from IoT devices and store it in BigQuery for analysis. They need to minimize latency and operational overhead. Which two Google Cloud services should they use? (Choose two.)

Accepted Answer

Cloud Dataflow. Cloud Pub/Sub is the recommended service for ingesting streaming data, and Cloud Dataflow can process the data and write it directly to BigQuery with low latency. Cloud Storage is for batch uploads, Cloud Functions is event-driven but not ideal for high-throughput streaming, and Cloud Dataproc is for batch processing.

Answer

Cloud Dataproc

Answer

Cloud Storage

Answer

Cloud Functions

Question 14

A startup is migrating its on-premises MySQL database (5 TB) to Cloud SQL. The database is mission-critical and downtime must be minimized. Which migration service should they use to reduce downtime?

Accepted Answer

Database Migration Service (DMS). Database Migration Service (DMS) supports continuous replication from on-premises MySQL to Cloud SQL, minimizing downtime. Other options like Transfer Appliance or Storage Transfer Service are for file transfers, not live databases.

Answer

Transfer Appliance

Answer

gcloud sql import command

Answer

Storage Transfer Service

Question 15

An e-commerce company uses Cloud SQL for MySQL for its transactional database. They need to run complex analytical queries on the same data without impacting OLTP performance. The analytical queries should be run on a read replica with minimal lag. Which solution is BEST?

Accepted Answer

Create a Cloud SQL read replica and run analytical queries on it. Creating a Cloud SQL read replica allows you to offload analytical queries to a separate instance that replicates from the primary using MySQL's native asynchronous replication. This isolates the OLTP workload from heavy analytical queries, and with proper configuration (e.g., using a higher machine type and enabling InnoDB buffer pool tuning on the replica), you can achieve minimal replication lag. The read replica supports the same MySQL engine, so complex analytical queries run without schema changes or data movement.

Answer

Use Data Studio directly on Cloud SQL primary instance

Answer

Migrate to Cloud Spanner to handle both workloads

Answer

Export the database to BigQuery and run queries there