Google PCA Practice Test 3 — 10 Questions

Question 1

A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?

Accepted Answer

Use Cloud Armor security policies with geographic-based denylist rules.. Cloud Armor security policies support geographic-based access control using denylist or allowlist rules that match client IP addresses against country-level geolocation data. This allows the security team to block traffic from specific countries at the edge, before it reaches the backend, which is the most efficient and compliant approach for GDPR enforcement.

Answer

Configure Cloud CDN to serve content only to EU-based users.

Answer

Set VPC firewall rules to allow traffic only from EU IP ranges.

Answer

Configure Identity-Aware Proxy (IAP) to require user authentication from allowed countries.

Question 2

Which THREE are valid methods to protect sensitive data in BigQuery?

Accepted Answer

Apply Cloud DLP de-identification transforms during data ingestion.. Cloud DLP de-identification transforms can be applied during data ingestion to automatically mask, tokenize, or redact sensitive data before it is stored in BigQuery. This ensures that sensitive information is protected at rest and is not accessible to unauthorized users, aligning with data security best practices.

Answer

Enable customer-managed encryption keys (CMEK) to encrypt sensitive columns.

Answer

Use IAM roles to grant access at the dataset level, which automatically masks sensitive data.

Question 3

A company is migrating a monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single Compute Engine instance and stores session state in local memory. The migration must support horizontal scaling and high availability. What should the company do to manage session state in the new architecture?

Accepted Answer

Refactor the application to store session state in Cloud Memorystore for Redis and make the application stateless.. Option A is correct because migrating to a stateless architecture with Cloud Memorystore for Redis allows the application to scale horizontally without session state being tied to any single pod. By externalizing session state to a managed, highly available Redis service, any pod can handle any request, which is essential for high availability and autoscaling in GKE.

Answer

Use a StatefulSet with a headless service to assign stable network identities to pods.

Answer

Use GKE Ingress with session affinity (sticky sessions) to route requests to the same pod.

Answer

Store session state in Cloud SQL using a replicated database.

Question 4

Which THREE options are valid strategies for disaster recovery (DR) in Google Cloud?

Accepted Answer

Deploy a mirrored environment in another region and use Traffic Director to fail over.. Option B is correct because Traffic Director, based on the xDS API (Envoy), can manage traffic routing across regions. By deploying a mirrored environment in another region and configuring Traffic Director with failover policies, you can redirect traffic to the secondary region if the primary fails, enabling a robust active-passive or active-active DR strategy.

Answer

Store hourly snapshots of Compute Engine disks in the same region.

Answer

Enable Cloud CDN to cache static content from multiple origins.

Question 5

Which TWO statements are true about Google Cloud VPC networks? (Select exactly 2.)

Accepted Answer

Subnets are regional resources and can span zones.. Option C is correct because Google Cloud VPC subnets are regional resources that can span multiple zones within the same region. This allows resources in different zones to use the same subnet without requiring additional routing or VPN configuration, providing high availability and fault tolerance within a region.

Answer

Each VPC network is regional in scope.

Answer

By default, no firewall rules are created in a new VPC.

Answer

VPC Peering supports transitive routing.

Question 6

An organization has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They launched a Compute Engine instance in subnet-a with an internal IP 10.0.1.2 and a public IP. They want the instance to only allow HTTPS traffic from the internet. Which firewall rule should they create?

Accepted Answer

Ingress rule: allow tcp:443, source 0.0.0.0/0, target tag 'https-server'. Option D is correct because the instance needs to accept incoming HTTPS traffic (TCP port 443) from the internet. An ingress firewall rule with source 0.0.0.0/0 allows traffic from any external IP, and applying it to instances with the target tag 'https-server' ensures only tagged instances are affected. This matches the requirement to allow only HTTPS from the internet.

Answer

Ingress rule: allow tcp:0-65535, source 0.0.0.0/0, target tag 'https-server'

Answer

Egress rule: allow tcp:443, destination 0.0.0.0/0, target tag 'https-server'

Answer

Ingress rule: allow tcp:443, source 10.0.0.0/16, target tag 'https-server'

Question 7

A company deploys a web application on Compute Engine behind a Global HTTPS Load Balancer. They need to restrict access to the application based on the client's IP address. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides IP-based access control at the edge of Google's network, integrated directly with the Global HTTPS Load Balancer. It allows you to create security policies with IP allow/deny rules that are evaluated before traffic reaches your Compute Engine instances, making it the appropriate service for client IP restriction at the load balancer level.

Answer

VPC firewall rules

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Question 8

An organization uses Cloud SQL for MySQL in a production environment. They need to ensure high availability with automatic failover in case of a zonal failure. Which configuration should they use?

Accepted Answer

Create a regional Cloud SQL instance with automatic failover.. A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

Answer

Create a read replica in a different region.

Answer

Export the database daily and import into a new instance if failure occurs.

Answer

Deploy Cloud SQL across multiple regions using cross-region replication.

Question 9

A financial services company runs a multi-tier application on Compute Engine. They need to restrict network access so that only the web tier can communicate with the application tier, and only the application tier can access the database tier. All VMs are in the same VPC network. What is the most secure way to implement this?

Accepted Answer

Use VPC firewall rules with target tags to allow traffic between specific tiers.. VPC firewall rules with target tags allow you to precisely control ingress and egress traffic between VM instances based on their assigned tags. By tagging web tier VMs with a tag like 'web-tier' and application tier VMs with 'app-tier', you can create a firewall rule that allows traffic from 'web-tier' to 'app-tier' on the required port (e.g., TCP 8080) and another rule allowing traffic from 'app-tier' to 'db-tier' on the database port (e.g., TCP 3306). This approach enforces the principle of least privilege within a single VPC network without introducing unnecessary complexity or breaking network isolation.

Answer

Use Identity-Aware Proxy (IAP) to manage network access between tiers.

Answer

Create separate VPC networks for each tier and use VPC peering.

Answer

Assign a unique service account to each tier and use IAM conditions to restrict traffic.

Question 10

A healthcare organization uses Cloud Storage to store protected health information (PHI). They have a compliance requirement to ensure that all objects in the bucket are encrypted with a customer-managed key (CMK) that is rotated every 90 days. They also need to log all access to the bucket and detect anomalous access patterns. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle. Option D is correct because Cloud Storage with CMEK via Cloud KMS allows the organization to use a customer-managed key that can be rotated every 90 days, meeting the compliance requirement. Cloud Audit Logs capture all access to the bucket, and Chronicle provides advanced security analytics to detect anomalous access patterns, fulfilling the logging and detection needs.

Answer

Cloud Storage with default encryption, Cloud Audit Logs, and Security Command Center

Answer

Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud DLP

Answer

Cloud Storage with CSEK, Cloud Audit Logs, and Security Command Center