Google PCA Practice Test 31 — 15 Questions

Question 1

A company is designing a hybrid network architecture connecting an on-premises data center to Google Cloud. They need high availability (99.99% SLA) and bandwidth up to 10 Gbps. They also need to use their existing MPLS circuits. Which THREE components should they include in the design? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Two VLAN attachments to two different edge availability domains.. VLAN attachments in Google Cloud are associated with edge availability domains (EADs), which represent physically independent failure domains within a zone. By attaching two VLAN attachments to two different EADs, the design ensures that a failure in one EAD does not affect the other, supporting the 99.99% SLA requirement. This is a key component of a highly available Dedicated Interconnect or Partner Interconnect setup.

Answer

Cloud CDN to cache content and reduce latency.

Answer

Cloud VPN tunnels with multiple gateways for failover.

Question 2

A company uses Cloud Composer to manage Apache Airflow workflows. They want to optimize costs. Which practice is most effective?

Accepted Answer

Configure auto scaling for the Cloud Composer environment. Cloud Composer supports autoscaling for its workers, which dynamically adjusts the number of worker pods based on the Airflow task queue depth. This directly optimizes costs by scaling down during low-load periods and scaling up only when needed, avoiding over-provisioning.

Answer

Use preemptible VMs for Airflow schedulers

Answer

Replace Cloud Composer with Cloud Functions for all workflows

Answer

Use small machine types for all Composer components

Question 3

A small company wants to store sensitive files in Cloud Storage and ensure they are encrypted with a key that they control and rotate automatically every 90 days. They are currently using the default encryption provided by Google Cloud. They need a solution that is easy to manage and does not require manual key rotation. What should they do?

Accepted Answer

Create a Cloud KMS key ring and key with CMEK, set a rotation period of 90 days, and configure the bucket to use that key.. Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow the company to control the key while leveraging automatic rotation. By creating a key ring and key with a 90-day rotation period, and configuring the Cloud Storage bucket to use that key, the company meets the requirement for automated rotation without manual intervention. This solution is easy to manage and integrates natively with Cloud Storage, avoiding the complexity of external encryption or scripting.

Answer

Use Cloud HSM to generate a key and handle encryption outside of Cloud Storage.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and write a script to rotate the key every 90 days.

Answer

Continue using default encryption as it is automatically rotated by Google.

Question 4

A financial services company requires that all data stored in Cloud Storage be encrypted with keys they manage, rotate, and audit. They also need to enforce encryption at the bucket level. Which configuration should they use?

Accepted Answer

Use Cloud KMS with customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) with Cloud KMS allow the company to manage, rotate, and audit their own encryption keys while enforcing encryption at the bucket level. This meets the requirement of controlling key lifecycle and auditing, as Cloud KMS integrates with Cloud Audit Logs for key usage tracking.

Answer

Use default Google-managed encryption

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Enable CMEK at the bucket level with a Cloud KMS key

Question 5

A company needs to run a batch job that processes data stored in Cloud Storage. The job runs once per day and takes about 2 hours on 8 vCPUs. Cost is the primary concern, and the job can be interrupted. Which compute option is MOST cost-effective?

Accepted Answer

Preemptible VM. Preemptible VMs (the predecessor to Spot VMs in GCP) are the most cost-effective option for batch workloads that can tolerate interruptions because they offer up to 80% discount compared to standard on-demand VMs. Since the job runs once per day for only 2 hours and can be interrupted, Preemptible VMs are ideal—they can be terminated at any time by GCP, but the job can be retried or resumed. Spot VMs are the modern equivalent, but Preemptible VMs are still available and are explicitly designed for fault-tolerant, short-lived batch processing.

Answer

Standard VM (on-demand)

Answer

Spot VM

Answer

Sole-tenant node

Question 6

Refer to the exhibit. An engineer deployed this Terraform configuration and can SSH to the instance using the external IP. However, they notice that the instance has a public IP address even though they intended to have no public IP. What change should be made to the configuration to ensure the instance does not get a public IP?

Accepted Answer

Remove the entire access_config block from the network_interface configuration.. The `access_config` block in a Terraform `google_compute_instance` resource is what assigns a public (external) IP address to the instance's network interface. By removing the entire `access_config` block, the instance will only receive a private IP address, fulfilling the requirement of no public IP. Leaving the block empty (as in option C) still creates an ephemeral external IP by default, so it does not solve the problem.

Answer

Change the metadata key enable-oslogin to FALSE.

Answer

Set access_config = [] instead of leaving it empty.

Answer

Set the network to a custom VPC that does not have external internet access.

Question 7

Which TWO methods can be used to encrypt data at rest in BigQuery?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) via Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow you to manage the encryption keys used to protect BigQuery data at rest via Cloud KMS. This gives you control over key rotation, access, and lifecycle, while BigQuery handles the encryption and decryption transparently. It is a supported method for encrypting data at rest in BigQuery.

Answer

Use a Cloud Storage bucket with bucket-level default encryption.

Answer

Use Cloud SQL with encryption at rest.

Answer

Use Cloud Bigtable with encryption at rest.

Question 8

Which TWO of the following are valid ways to deploy a Cloud Function? (Choose two.)

Accepted Answer

gcloud functions deploy. `gcloud functions deploy` is the primary command-line interface (CLI) method to deploy a Cloud Function directly from a local source or a specified source location. Option E is correct because Cloud Build triggers can be configured to automatically deploy a Cloud Function whenever a change is pushed to a repository (e.g., Cloud Source Repositories, GitHub), enabling continuous deployment.

Answer

Cloud Source Repositories

Answer

Cloud Run

Answer

Cloud Scheduler

Question 9

A company runs a web application on Compute Engine instances. The application stores session state in files on local SSD. The company wants to reduce costs without sacrificing performance for a predictable traffic pattern. What should they do?

Accepted Answer

Use preemptible VMs in a managed instance group with autoscaling, and store session state in Redis (Memorystore).. Preemptible VMs reduce compute costs by up to 80%, and using a managed instance group with autoscaling handles the predictable traffic pattern efficiently. Storing session state in Redis (Memorystore) instead of local SSD ensures session data persists across VM preemptions and is shared among instances, which is critical for stateful applications. This combination maintains performance while eliminating the cost of always-on VMs.

Answer

Change the machine type to N2 standard and use committed use discounts.

Answer

Keep local SSDs but use sole-tenant nodes to reduce contention.

Answer

Migrate the session state to Cloud Firestore and use preemptible VMs.

Question 10

Refer to the exhibit. Which statement is true about this Deployment Manager template?

Accepted Answer

The VM will have a public IP address.. The Deployment Manager template includes the property `type: ONE_TO_ONE_NAT` under the `accessConfigs` block, which configures a NAT on the network interface and automatically assigns an ephemeral external IP address to the VM, giving it a public IP address.

Answer

The VM will be created in the us-central1-b zone.

Answer

The VM will use a custom machine type.

Answer

The boot disk will not be deleted when the VM is deleted.

Question 11

A company uses BigQuery for analytics. They have a large partitioned table that is queried frequently. The query performance has degraded over time. Which optimization should they try first?

Accepted Answer

Apply clustering on frequently filtered columns.. Clustering on frequently filtered columns reorganizes the data within partitions based on the values of those columns, which allows BigQuery to prune blocks more effectively during queries. This directly addresses the performance degradation by reducing the amount of data scanned, without requiring additional storage or compute resources.

Answer

Create a materialized view for each frequent query.

Answer

Increase the number of slots for the project.

Answer

Denormalize the table to reduce joins.

Question 12

Match each GCP database service to its type.

Accepted Answer

Cloud SQL: Relational database. Correct matches: Cloud SQL (Relational), Firestore (NoSQL document), Bigtable (NoSQL wide-column). Common confusions include mistaking Cloud Spanner or Memorystore for other types, or confusing Datastore with cache services.

Answer

Cloud Spanner: NoSQL document database

Answer

Memorystore: Relational database

Answer

Datastore: In-memory cache

Question 13

Match each IAM role type to its description.

Accepted Answer

Basic roles: Broad roles that apply to all resources in a project (Owner, Editor, Viewer). In GCP, IAM roles are categorized into basic (broad), predefined (service-specific), and custom (user-defined). Common confusions arise between predefined and custom roles.

Answer

Basic roles: Roles curated by Google Cloud that provide fine-grained access for specific services

Answer

Predefined roles: Roles that you create to tailor permissions to your organization's specific needs

Question 14

Your company is using Cloud Storage to store sensitive customer data. The security team requires that all objects be encrypted with a customer-managed encryption key (CMEK) and that the key be automatically rotated every 90 days. You need to implement this without changing the application code. You have created a Cloud KMS key ring and a key with rotation period set to 90 days. What additional configuration is required?

Accepted Answer

Set the default encryption key of the Cloud Storage bucket to the Cloud KMS key.. Setting the default encryption key of the Cloud Storage bucket to the Cloud KMS key ensures that all objects written to the bucket are automatically encrypted with that CMEK, without requiring any application code changes. The Cloud KMS key's rotation period of 90 days is already configured, so the key will be rotated automatically, meeting the security team's requirement.

Answer

Set a bucket lifecycle rule to transition objects to a different storage class.

Answer

Create a custom customer-supplied encryption key (CSEK) and provide it in each request.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.

Question 15

A company runs a stateful workload on Compute Engine with regional persistent disks (PD). They need to implement a disaster recovery (DR) plan with a Recovery Point Objective (RPO) of less than 1 hour and Recovery Time Objective (RTO) of less than 4 hours. Which THREE steps should they include in their DR plan? (Choose three.)

Accepted Answer

Take snapshots of the persistent disk every 30 minutes and copy them to a Cloud Storage bucket in another region. Taking snapshots every 30 minutes meets the RPO of less than 1 hour. By copying these snapshots to a Cloud Storage bucket in another region, you ensure data is available in a DR region for recovery, which is essential for cross-region disaster recovery.

Answer

Create a snapshot schedule for the persistent disk every 4 hours

Answer

Use regional persistent disks to automatically replicate data to a second zone