Google PCA Practice Test 1 — 30 Questions

Question 1

A financial services company is designing a multi-region application on Google Kubernetes Engine (GKE) for high availability. They need to serve user requests from the closest region and automatically failover if a region becomes unavailable. Which architecture should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy GKE clusters in multiple regions and use a multicluster ingress with an external HTTP(S) load balancer set up with the global external backend.. Deploying GKE clusters in multiple regions and using a multicluster ingress with a global external HTTP(S) load balancer enables traffic routing to the closest healthy backend cluster based on latency or geography, and automatically fails over to another region if one becomes unavailable. The global external backend configuration allows the load balancer to distribute traffic across multiple regional GKE clusters, providing both proximity-based routing and high availability.

Answer

Use a global external HTTP(S) load balancer with a single backend service pointing to one regional cluster.

Answer

Use Cloud CDN in front of a single regional GKE cluster to cache content.

Answer

Use a single regional GKE cluster with auto-scaling across zones.

Question 2

A web application running on Compute Engine behind a global HTTP(S) load balancer experiences high latency during traffic spikes. Which quick fix would best address this issue without changing the architecture?

Accepted Answer

Configure managed instance group autoscaling to add more instances.. Managed instance group (MIG) autoscaling dynamically adds more instances when CPU utilization or other metrics exceed a threshold, directly absorbing the increased traffic during spikes. This is the quickest fix because it requires no architectural changes—just configuring autoscaling parameters on the existing MIG. By scaling out horizontally, the load balancer can distribute requests across more backends, reducing per-instance load and latency.

Answer

Enable Cloud CDN on the load balancer.

Answer

Switch to a regional load balancer to reduce latency.

Answer

Increase the machine type of the backend instances.

Question 3

A startup runs a web application on App Engine standard environment. They want to ensure the application can handle sudden traffic spikes without manual intervention. Which App Engine feature should they configure?

Accepted Answer

Automatic scaling with a maximum number of idle instances.. App Engine's automatic scaling with a maximum number of idle instances is designed to handle sudden traffic spikes by dynamically creating and removing instances based on request load. This configuration allows the application to scale up quickly when traffic increases, ensuring responsiveness without manual intervention, while the maximum idle instances setting prevents over-provisioning and controls costs.

Answer

Manual scaling with a fixed number of instances.

Answer

Basic scaling with automatic instance creation.

Answer

Resident instances with a minimum number of always-on instances.

Answer

Custom scaling based on CPU utilization.

Question 4

A large enterprise is migrating their on-premises data center to Google Cloud. They have hundreds of VMs and need to minimize network latency between on-prem and cloud during migration. They have high bandwidth requirements. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, high-bandwidth, low-latency connection between on-premises data centers and Google Cloud, bypassing the public internet. This is ideal for large-scale migrations with hundreds of VMs where minimizing latency and ensuring consistent throughput is critical.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Peering with Google

Question 5

A company deploys a critical application on Google Kubernetes Engine (GKE) and wants to ensure high availability during cluster upgrades. Which TWO practices should they follow?

Accepted Answer

Use multiple node pools across different zones within the cluster.. Deploying multiple node pools across different zones ensures that if one zone fails or is taken down for maintenance, the application can continue serving from the other zones. This aligns with GKE's best practice for high availability by distributing workloads across failure domains. Option C is correct because PodDisruptionBudgets (PDBs) define the minimum number of pods that must remain available during voluntary disruptions like cluster upgrades, preventing the upgrade from taking down too many replicas at once.

Answer

Use a single-zone node pool with multiple replicas.

Answer

Enable cluster autoscaling to add nodes during upgrades.

Answer

Enable regional clusters for multi-zone control plane.

Question 6

A company is using BigQuery for data analytics. They want to optimize costs while maintaining query performance. Which TWO actions should they take? (Choose 2.)

Accepted Answer

Partition tables by date.. Partitioning tables by date (Option C) is correct because it allows BigQuery to prune partitions during query execution, scanning only the relevant date ranges instead of the entire table. This reduces the amount of data processed, directly lowering query costs under on-demand pricing while maintaining performance through reduced I/O.

Answer

Use reserved slots with flat-rate pricing.

Answer

Always use SELECT *.

Answer

Materialize frequently used queries as tables.

Question 7

A company uses Cloud SQL for PostgreSQL for their transactional database. They need a disaster recovery solution that provides cross-region failover with a recovery point objective (RPO) of less than 1 minute. Which solution meets these requirements?

Accepted Answer

Create a cross-region read replica and promote it during failover. A cross-region read replica in Cloud SQL for PostgreSQL can be promoted to a standalone instance during a disaster, enabling failover to another region. The replica uses PostgreSQL's native streaming replication, which typically provides an RPO of less than 1 minute because changes are replicated asynchronously but with very low latency. This meets the stated RPO requirement without needing to redesign the application for global consistency.

Answer

Use Cloud Spanner for global strong consistency

Answer

Use a Cloud SQL for PostgreSQL instance with multiple zones

Answer

Take daily automated backups and restore in another region

Question 8

An organization needs to encrypt data at rest in BigQuery using keys that are rotated every 90 days. They want to manage the keys themselves but cannot store keys on-premises. Which encryption approach should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS. CMEK with Cloud KMS allows customers to manage their own keys (including rotation) while keys are stored in Google's Cloud KMS.

Answer

Default Google-managed encryption

Answer

Cloud HSM

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 9

A security team needs to detect and redact personally identifiable information (PII) in documents stored in Cloud Storage before sharing them with external partners. Which two Google Cloud services should they use together? (Choose two.)

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud DLP can scan Cloud Storage for PII and de-identify the data. The scanned and de-identified results can be written back to Cloud Storage. Cloud Dataflow is not needed for this simple use case; Cloud Function can trigger DLP jobs.

Answer

Cloud KMS

Answer

Cloud Dataflow

Answer

Cloud NAT

Question 10

A company is migrating an on-premises Oracle database to Google Cloud. They want to minimize application changes and need a fully managed, PostgreSQL-compatible database with high performance for OLTP workloads. Which service is MOST suitable?

Accepted Answer

AlloyDB. AlloyDB is a fully managed, PostgreSQL-compatible database optimized for high-performance OLTP workloads, designed for migration from Oracle with minimal changes. Cloud SQL for PostgreSQL is also managed but does not offer the same performance optimizations as AlloyDB. Cloud Spanner is global and SQL-compatible but may require application changes. Bigtable is NoSQL.

Answer

Bigtable

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Spanner

Question 11

A company wants to run a containerized web application that experiences unpredictable traffic spikes. They want to pay only for resources used during request processing, with no idle cost. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero when not in use and charges per request. It eliminates idle costs. GKE Autopilot has a per-pod billing model but still incurs some cost for the cluster control plane. App Engine Standard supports scaling to zero but is limited to specific runtimes. Compute Engine VMs incur cost for running instances even if idle.

Answer

Google Kubernetes Engine (GKE) Autopilot

Answer

App Engine Standard

Answer

Compute Engine with managed instance groups

Question 12

A developer is using Cloud Build to automate deployments. The build fails with an error: 'Permission 'iam.serviceAccounts.actAs' denied.' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Service Account User role on the service account used in the build steps. The error 'Permission iam.serviceAccounts.actAs denied' occurs when a Cloud Build build step tries to impersonate a service account (e.g., to deploy resources) but the Cloud Build service account lacks the Service Account User role on that target service account. Option D correctly identifies that the Cloud Build service account does not have the `roles/iam.serviceAccountUser` role on the service account used in the build steps, which is required to delegate access.

Answer

The developer does not have iam.serviceAccounts.actAs permission on the project

Answer

The build configuration is missing a required step

Answer

The Cloud Build service account is not enabled

Question 13

A global e-commerce platform uses Cloud Spanner for product inventory and wants to reduce costs. They notice that read replicas are underutilized and that most queries are single-key reads. Which configuration change will reduce costs while maintaining availability?

Accepted Answer

Downgrade the instance to a smaller regional configuration with fewer nodes. For Spanner, read replicas are used for read-only workloads; if underutilized, reducing the number of read replicas can lower costs without affecting write availability. However, fine-grained instance configuration changes are not straightforward; the best option is to adjust the number of nodes or use a smaller instance class. But among options, choosing a smaller regional configuration (fewer nodes) is practical.

Answer

Use Cloud SQL for reads and Spanner for writes only

Answer

Switch to a multi-region configuration with witness nodes

Answer

Reduce the number of read replicas in the instance configuration

Question 14

A company runs a latency-sensitive web application on Compute Engine in us-east1. They want to improve response times for users in Europe and Asia without changing the application architecture. Which TWO actions should they take? (Choose 2.)

Accepted Answer

Enable Cloud CDN on the load balancer. Cloud CDN caches static content at edge locations globally, reducing latency for users worldwide. Placing a load balancer in multiple regions (multi-region load balancing with proximity-based routing) directs users to the nearest backend region. Using only us-west1 would still leave European users far away. Cloud Armor is for security, not performance. Spot VMs are for cost savings, not latency.

Answer

Use preemptible VMs to reduce cost

Answer

Deploy additional instances in us-west1

Answer

Use Cloud Armor to block high-latency requests

Question 15

An organization runs a Kubernetes cluster on GKE with cluster autoscaling enabled. They notice that pods are frequently in 'Pending' state due to insufficient CPU, but the cluster autoscaler does not add nodes quickly enough. What is the most likely cause?

Accepted Answer

The node pool has reached the maximum node count limit.. The cluster autoscaler cannot add new nodes if the node pool has already reached its maximum node count limit. This limit is configured at the node pool level in GKE, and once reached, the autoscaler will not scale up further, leaving pods in 'Pending' state due to insufficient CPU resources.

Answer

The cluster autoscaler is using the 'least-waste' expander.

Answer

The horizontal pod autoscaler (HPA) is misconfigured.

Answer

The pod disruption budget (PDB) is too restrictive.

Question 16

A startup is building a serverless application that processes events from Cloud Storage buckets. Each event triggers a Python function that resizes images. Which GCP compute service is MOST suitable for this event-driven workload?

Accepted Answer

Cloud Functions. Cloud Functions is designed for event-driven, serverless compute. It can be triggered directly by Cloud Storage events (object finalize/create). Cloud Run requires HTTP invocation, App Engine is for web apps, and Compute Engine VMs require management.

Answer

Cloud Run

Answer

Compute Engine

Answer

App Engine

Question 17

An organization wants to protect an HTTPS load-balanced web application from common web attacks, such as SQL injection and cross-site scripting (XSS), as well as rate-limit traffic from specific IPs. Which three capabilities should they use together? (Choose three.)

Accepted Answer

Cloud Armor rate limiting. Cloud Armor provides WAF rules (preconfigured rules for SQLi, XSS, etc.), rate limiting, and IP blacklisting/whitelisting. All three are part of Cloud Armor security policies.

Answer

Cloud CDN

Answer

Cloud Load Balancing logging

Question 18

A company wants to use a multi-cloud strategy to avoid vendor lock-in and run workloads on both Google Cloud and AWS. They need to manage Kubernetes clusters across both environments consistently. Which TWO Google Cloud services can help achieve this?

Accepted Answer

Config Sync. Anthos (now GKE Enterprise) provides a consistent Kubernetes platform across on-premises and multiple clouds, including AWS. Config Sync is a component of Anthos that enables configuration management across clusters. BigQuery Omni allows querying data across clouds but is for analytics. Cloud Run is serverless and not for multi-cloud Kubernetes management. GKE on AWS is deprecated; Anthos is the recommended approach.

Answer

Cloud Run

Answer

BigQuery Omni

Answer

GKE on AWS

Question 19

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Accepted Answer

Cloud Deploy. Cloud Build handles the build and test steps, builds the Docker image, and pushes to Artifact Registry. Cloud Deploy manages the deployment to GKE. Cloud Run is serverless; Cloud Functions is event-driven; Compute Engine is VMs.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Cloud Run

Question 20

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using the pod's own identity, without managing long-lived credentials. They have created a Google service account (GSA) and a Kubernetes service account (KSA). What should they do to bind the KSA to the GSA?

Accepted Answer

Add an annotation to the KSA referencing the GSA, and grant the KSA the iam.workloadIdentityUser role on the GSA. Workload Identity allows you to configure a KSA to act as a GSA by adding an annotation to the KSA and granting the GSA the necessary IAM role. The GSA does not impersonate the KSA; the KSA impersonates the GSA. The annotation is set on the KSA, not the pod. The GSA does not need to be bound to the KSA via an IAM role on the KSA.

Answer

Create a service account key and mount it as a secret in the pod

Answer

Grant the GSA the roles/iam.serviceAccountUser role on the project

Answer

Add an annotation to the GSA referencing the KSA, and grant the KSA the iam.workloadIdentityUser role on the GSA