Google PCA Practice Test 31 — 15 Questions

Question 1

A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs record API calls that read or modify user data, including calls to Cloud KMS for encryption and decryption operations. To audit who used a CMEK key and when, you need Data Access audit logs for Cloud KMS, as these logs capture key usage events such as Encrypt, Decrypt, and GenerateDataKey. Admin Activity logs only record changes to resource configurations, not data access.

Answer

Network Security audit logs

Answer

Admin Activity audit logs

Answer

System Event audit logs

Question 2

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Accepted Answer

The developer is assigned only the objectViewer role. The correct answer is D: the developer is assigned only the objectViewer role. The objectViewer role (roles/storage.objectViewer) grants read-only access to objects, including listing and downloading, but it does not include storage.objects.create, so any upload attempt will fail with a permission denied error. Options A and B are unlikely because an organization policy denying all writes or project non-membership would typically produce broader failures or different errors, and there is no evidence in the scenario. Option C is incorrect because IAM permissions are additive; a service account's permissions do not override or reduce a user's granted roles, so my-sa cannot strip the developer's access.

Answer

An organization policy denies all write operations

Answer

The developer is not a member of the project

Answer

The service account my-sa overrides the developer's permissions

Question 3

A company runs a Kubernetes cluster on GKE. They need to ensure that pods cannot access Google Cloud APIs unless explicitly allowed through a service account. Which GKE feature should they use?

Accepted Answer

Workload Identity. Workload Identity is the correct choice because it allows pods in GKE to authenticate to Google Cloud APIs using a specific Google service account, rather than the default Compute Engine service account. This ensures that pods cannot access any Google Cloud APIs unless explicitly granted permission via IAM roles bound to that service account, meeting the requirement for least-privilege access.

Answer

Network Policies

Answer

Pod Security Policies

Answer

Cloud Audit Logs

Question 4

An engineer needs to grant a user the ability to create and manage service accounts in a project. Which predefined IAM role provides these permissions?

Accepted Answer

roles/iam.serviceAccountAdmin. The predefined role roles/iam.serviceAccountAdmin provides permissions to create and manage service accounts within a project. It includes actions like creating, deleting, and updating service accounts, as well as managing their IAM policies. This role is specifically designed for service account administration.

Answer

roles/owner

Answer

roles/editor

Answer

roles/iam.workloadIdentityUser

Question 5

You need to monitor the performance of a production Cloud Run service and set an alert when the p99 latency exceeds 500 ms over a 5-minute window. Which combination of Cloud Monitoring resources should you use?

Accepted Answer

Define an alerting policy using the metric 'run.googleapis.com/request_latencies' with a percentile aggregator and threshold condition. Cloud Run exposes request latency as the built-in metric run.googleapis.com/request_latencies, which can be aggregated with a percentile aligner (e.g., 99th percentile) over a 5-minute window and used in a Cloud Monitoring alerting policy with a threshold of 500 ms. This is the native, lowest-latency path for p99 latency alerting on Cloud Run.

Answer

Create a log-based metric for latency and an alerting policy with a condition on the count of logs

Answer

Use Cloud Logging to export logs to BigQuery and run a scheduled query to check latency

Answer

Create an uptime check and set an alert on the check response time

Question 6

A company commits to using Compute Engine for 3 years and wants the maximum discount. Which purchasing option should they use?

Accepted Answer

3-year committed use discount.. A 3-year committed use discount (CUD) offers the highest discount rate (up to 57% for most machine types) compared to 1-year CUDs (up to 37%) or pay-as-you-go pricing. By committing to a consistent resource usage for the full 3-year term, the company maximizes the discount on Compute Engine costs.

Answer

Pay-as-you-go pricing.

Answer

Sustained use discounts.

Answer

1-year committed use discount.

Question 7

Which two GCP audit log types are available by default? (Choose TWO).

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (A) are enabled by default and always written for free, capturing administrative operations that modify resource configurations or metadata, such as creating a VM or changing IAM policies. System Event audit logs (B) are also enabled by default and record Google Cloud system-generated actions that modify resources, such as live migration of a VM or automatic restart by a scheduler, and they cannot be disabled. Cloud Audit Logs (C) is not a log type but the overall umbrella service comprising Admin Activity, Data Access, System Event, and Policy Denied logs, so it is not one of the two default types. Policy Denied audit logs (D) are only written when a security policy such as VPC Service Controls denies a request, and Data Access audit logs (E) are disabled by default (except for BigQuery) and must be explicitly enabled per service, so neither is available by default.

Answer

Cloud Audit Logs

Answer

Policy Denied audit logs

Answer

Data Access audit logs

Question 8

A startup wants to deploy a containerised web application that auto-scales based on HTTP request traffic, with no infrastructure management. They expect unpredictable traffic spikes. Which compute service is most suitable?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that automatically scales container instances based on incoming HTTP requests (including scale-to-zero), requires no cluster or VM management, and is purpose-built for stateless containerised web workloads with unpredictable traffic. It handles HTTP load balancing, TLS, and concurrency tuning natively, matching the startup's requirements exactly.

Answer

Compute Engine with managed instance groups

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Autopilot

Question 9

A company wants to analyze their Google Cloud spending and receive recommendations for rightsizing resources. Which tool provides this functionality?

Accepted Answer

Active Assist. Active Assist includes recommendations for rightsizing Compute Engine VMs, Cloud SQL instances, and more. BigQuery Reservations is for slot management. Cloud Billing reports show costs but not recommendations. Pricing Calculator estimates costs.

Answer

BigQuery Reservations

Answer

Google Cloud Pricing Calculator

Answer

Cloud Billing reports

Question 10

A company has a production database running on Cloud SQL. They need to ensure high availability with automatic failover in the event of a zone outage. What should they do?

Accepted Answer

Enable Cloud SQL High Availability (HA) configuration.. Enabling Cloud SQL High Availability (HA) configuration provisions a standby instance in a different zone within the same region, using synchronous replication to ensure zero data loss. In the event of a zone outage, Cloud SQL automatically fails over to the standby instance, typically within 60 seconds, providing high availability without manual intervention.

Answer

Export the database to Cloud Storage and import in another region.

Answer

Create a cross-region read replica.

Answer

Configure automated backups.

Question 11

A startup wants to grant a contractor limited access to a single Cloud Storage bucket. The contractor should be able to view and download objects, but not delete or overwrite them. Which IAM role should be assigned?

Accepted Answer

roles/storage.objectViewer. The roles/storage.objectViewer role grants read-only access to objects in a bucket, including listing and downloading objects, but does not allow modification or deletion.

Answer

roles/storage.admin

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectCreator

Question 12

A company deploys a Kubernetes workload in GKE that needs to access Cloud Storage. They want to avoid managing service account keys. What is the recommended approach?

Accepted Answer

Use Workload Identity to map the Kubernetes service account to a GCP service account.. Workload Identity is the recommended way for GKE workloads to authenticate to Google Cloud services without managing long-lived service account keys. It binds a Kubernetes service account (KSA) to a Google Cloud service account (GSA) via IAM, and the GKE metadata server issues short-lived credentials to the pod automatically. This eliminates key rotation, storage, and leakage risks.

Answer

Use the default Compute Engine service account on the node.

Answer

Store a service account key in a Kubernetes secret and mount it.

Answer

Use Cloud Key Management Service to encrypt the service account key.

Question 13

A developer is migrating a stateful application to GKE. The application requires persistent storage with high IOPS for a database. Which storage option is most suitable?

Accepted Answer

Persistent Disk SSD. Persistent Disk SSD (pd-ssd) is the most suitable option for a stateful database on GKE requiring high IOPS because it provides block storage with consistent, high-performance IOPS and can be dynamically provisioned via PersistentVolumeClaims. Unlike Local SSD, pd-ssd persists data independently of the node lifecycle, ensuring data durability during pod rescheduling or node failures.

Answer

Local SSD

Answer

Cloud Storage Fuse

Answer

Persistent Disk Standard

Question 14

An organization wants to export their Cloud Logging logs to a centralized BigQuery dataset for long-term analysis. They also need to exclude logs from a specific source (e.g., a test project) to reduce costs. How should they set this up?

Accepted Answer

Create a log sink to BigQuery and add a log exclusion filter that excludes the test project's logs. A log sink to BigQuery with an exclusion filter is the correct way to export logs to a centralized dataset while excluding logs from a specific source. The exclusion filter is applied at the sink level, so logs from the test project are not exported, reducing costs. This setup can be created at the organization level to aggregate logs from multiple projects.

Answer

Disable logging in the test project

Answer

Create two separate sinks: one for production logs to BigQuery and another for test logs to Cloud Storage

Answer

Create a log sink to BigQuery and use IAM to restrict access to the test project's logs

Question 15

A startup wants to deploy a web application on Google Cloud with a MySQL database. They anticipate low traffic initially but want the ability to scale seamlessly. They also want to minimize operational overhead. Which combination of services should they choose?

Accepted Answer

App Engine Standard Environment with Cloud SQL.. App Engine Standard Environment provides a fully managed, autoscaling platform for web applications, while Cloud SQL offers a managed MySQL database with automatic replication and backups. This combination minimizes operational overhead because Google handles infrastructure provisioning, patching, and scaling, and Cloud SQL integrates natively with App Engine via the Cloud SQL proxy or Unix socket, requiring no manual configuration for connectivity.

Answer

Compute Engine with a self-managed MySQL instance.

Answer

Cloud Run with Cloud Spanner.

Answer

Google Kubernetes Engine (GKE) with Cloud SQL.