Google PCA Practice Test 32 — 15 Questions

Question 1

An organization uses Cloud Functions (2nd gen) for event-driven processing. They notice that some functions fail with 'memory limit exceeded' errors during peak load. The function processes messages from Pub/Sub and writes to Firestore. What should they do to improve reliability without sacrificing throughput?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the memory allocated to the Cloud Function.. The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.

Answer

Increase the maximum number of concurrent function instances.

Answer

Enable Pub/Sub batching to reduce the number of function invocations.

Answer

Split the function into multiple smaller functions, each handling a subset of the data.

Question 2

A company is building a real-time data pipeline that ingests events from IoT devices, processes them with Apache Beam, and stores results in BigQuery for analytics. The pipeline must handle spikes in traffic and guarantee exactly-once processing. Which combination of services should they use?

Accepted Answer

Cloud Pub/Sub, Dataflow, and BigQuery.. Cloud Pub/Sub provides scalable, asynchronous ingestion for IoT event spikes, Dataflow (which runs Apache Beam) offers exactly-once processing semantics via checkpointing and idempotent sinks, and BigQuery serves as the analytics destination. This combination meets all requirements: Pub/Sub decouples producers from consumers, Dataflow handles stateful processing with exactly-once guarantees, and BigQuery supports real-time streaming inserts.

Answer

Cloud Pub/Sub, Dataproc, and BigQuery.

Answer

Cloud IoT Core, Data Fusion, and Cloud Bigtable.

Answer

Cloud Storage, Cloud Functions, and BigQuery.

Question 3

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Accepted Answer

The VM was created without an external IP address. The most likely reason for the timeout is that the VM was created without an external (public) IP address. Without an external IP, the VM is not directly reachable from the internet, even if nginx is running and firewall rules allow HTTP traffic. The timeout occurs because the internet has no route to the VM's private IP address.

Answer

The VM is in a subnet without a Cloud NAT

Answer

The firewall rule allowing HTTP traffic is missing

Answer

The startup script failed to install nginx

Question 4

A healthcare organization is storing sensitive patient data in Cloud Storage. They need to ensure that all objects are encrypted with a key managed by their on-premises HSM. Which encryption approach should they use?

Accepted Answer

Use Cloud External Key Manager (EKM) with a key hosted on the on-premises HSM.. Cloud External Key Manager (EKM) allows you to use an external key management system, such as an on-premises HSM, to manage encryption keys for Google Cloud services. This approach meets the requirement because the key never leaves the HSM, and Cloud Storage uses the key via the EKM integration, ensuring the organization retains full control over the key lifecycle.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and store the key in a Secret Manager accessible only from the on-premises HSM.

Answer

Use Customer-Managed Encryption Keys (CMEK) with a Cloud KMS key that is generated from the on-premises HSM.

Answer

Encrypt each object client-side with a key from the on-premises HSM before uploading to Cloud Storage.

Question 5

A company runs a web application on Compute Engine instances behind a global HTTP(S) Load Balancer. The application uses Cloud SQL for MySQL for user data. Users report that during peak hours, the page load times increase significantly. The development team notices that the number of database connections exceeds the maximum allowed, causing some requests to fail. The application is designed to use connection pooling with a maximum pool size of 100 connections per instance. There are currently 10 instances. The Cloud SQL instance is configured with 4 vCPUs and 15 GB memory, and the maximum connections is set to 400. The application team wants to minimize cost while resolving the issue. What should the architect recommend?

Accepted Answer

Reduce the max pool size per instance to 40 connections.. With 10 instances each configured for a max pool size of 100, the total potential connections is 1000, far exceeding the Cloud SQL limit of 400. Reducing the pool size to 40 per instance brings the total to exactly 400, fitting within the limit without any additional cost. Option B increases the instance tier, which adds cost unnecessarily when the current tier is sufficient with proper connection sizing. Option C is not feasible because load balancers do not manage database connection pooling. Option D does not reduce the total number of connections and adds complexity without solving the core issue.

Answer

Increase the Cloud SQL instance tier to have more vCPUs and memory.

Answer

Implement connection pooling at the global HTTP(S) Load Balancer level.

Answer

Use Cloud SQL Proxy with connection pooling.

Question 6

A developer wants to monitor a custom application metric from their application running on GKE. What should they use?

Accepted Answer

Cloud Monitoring custom metrics API. Cloud Monitoring custom metrics API (option D) is the correct choice because it allows a developer to push custom application-specific metrics (e.g., request latency, queue depth) from a GKE pod using the `custom.googleapis.com` metric domain. This integrates directly with Cloud Monitoring for alerting and dashboards, whereas Cloud Logging is for log data, not metrics.

Answer

Cloud Logging

Answer

Cloud Trace

Answer

Cloud Debugger

Question 7

During a load test, an application running on GKE experiences high latency and errors. You suspect the issue is due to insufficient cluster resources. Which gcloud command should you use to quickly check the current resource utilization of all nodes in the cluster?

Accepted Answer

gcloud compute instances list. None of the listed gcloud commands shows current resource utilization of GKE nodes. gcloud container clusters describe shows configuration, gcloud container clusters list lists clusters, gcloud container clusters get-credentials retrieves credentials, and gcloud compute instances list only lists instances and their status. The correct command for current CPU/memory utilization is kubectl top nodes.

Answer

gcloud container clusters describe

Answer

gcloud container clusters list

Answer

gcloud container clusters get-credentials

Question 8

An organization is using Cloud Interconnect to connect their on-premises network to Google Cloud. They need to ensure 99.99% availability for their connection. Which configuration meets this requirement?

Accepted Answer

Two Dedicated Interconnect connections from different edge locations. To achieve 99.99% availability with Cloud Interconnect, you need two Dedicated Interconnect connections from different edge locations. This provides redundancy and meets the SLA requirement. A single connection (Dedicated or Partner) does not meet the 99.99% SLA. HA VPN is not a Cloud Interconnect solution; it's a separate VPN service that can also provide 99.99% SLA but is not Cloud Interconnect. Since the organization is using Cloud Interconnect, the correct configuration is two Dedicated Interconnect connections from different edge locations.

Answer

A single Partner Interconnect connection at 1Gbps

Answer

A single Dedicated Interconnect connection at 10Gbps

Answer

High Availability VPN (HA VPN) with two gateways and four tunnels

Question 9

An engineer wants to migrate an on-premises MySQL database (5.6) to Cloud SQL for MySQL with minimal downtime. Which service should they use?

Accepted Answer

Database Migration Service. Database Migration Service (DMS) supports continuous replication from on-premises MySQL to Cloud SQL, enabling minimal downtime migration. Velostrata (Migrate for Compute Engine) is for VM migration. Storage Transfer Service is for file/object data. BigQuery Data Transfer Service is for analytics data.

Answer

Migrate for Compute Engine (formerly Velostrata)

Answer

Storage Transfer Service

Answer

BigQuery Data Transfer Service

Question 10

A team uses Cloud Build for CI/CD. The builds are taking longer than expected due to dependency downloads. What is the best practice to speed up builds?

Accepted Answer

Use Docker layer caching with Cloud Build by specifying a cache image or using Kaniko cache.. Docker layer caching allows Cloud Build to reuse previously built layers, significantly reducing the time spent re-downloading and re-installing dependencies. By specifying a cache image or using Kaniko's built-in cache, only changed layers are rebuilt, while unchanged dependency layers are pulled from the cache instead of being fetched from the internet each time.

Answer

Increase the machine type to e2-highcpu-32 to speed up compilation.

Answer

Use Artifact Registry to store built packages and pull them during build.

Answer

Store dependencies in Cloud Source Repositories and fetch them during build.

Question 11

A financial services company is migrating a monolithic Java application to Google Kubernetes Engine (GKE) for improved scalability and reliability. The application serves real-time trading data and has strict latency requirements. Post-migration, the team observes frequent pod restarts due to OutOfMemory (OOM) errors, increased latency during peak trading hours, and occasional database connection timeouts. The current setup uses a single GKE cluster with a node pool of n1-standard-4 machines, a stateless application deployed as a Deployment with resource requests and limits set to 512 Mi memory and 1 CPU. The database is a Cloud SQL PostgreSQL instance with 2 vCPUs and 7.5 GB memory, and applications connect using a hardcoded connection string. The team wants to ensure reliable operation under load and during node maintenance events. Which course of action best addresses the reliability issues?

Accepted Answer

Adjust resource requests to 1 Gi memory and 2 CPU, set limits to 2 Gi and 4 CPU, create an HPA based on a custom metric (e.g., requests per second), enable cluster autoscaler, implement Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max connection pool size, and configure PDB with maxUnavailable 1.. Best addresses all reliability issues. Adjusting resource requests to 1 Gi memory and 2 CPU ensures proper scheduling, while limits of 2 Gi and 4 CPU prevent OOM errors. The HPA based on custom metrics (e.g., requests per second) scales pods proactively during peak trading hours. Cluster autoscaler handles node capacity, and Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max pool size prevents database connection timeouts. Finally, a PDB with maxUnavailable 1 ensures availability during node maintenance. Option B misses resource tuning, autoscaling, and connection pooling. Option C unnecessarily moves the database to GKE, increasing complexity and losing managed DB benefits. Option D lacks custom metric HPA, cluster autoscaler, and PDB, leaving gaps in scalability and maintenance handling.

Answer

Enable GKE node auto-upgrade, configure Pod Disruption Budgets (PDB) with minAvailable 1, and set readiness probes to check application health.

Answer

Migrate the database to a StatefulSet in GKE with persistent volumes, increase node count to 10, and enable cluster autoscaler.

Answer

Increase memory limits to 2 Gi and CPU to 2, add Horizontal Pod Autoscaler (HPA) based on CPU utilization, and implement connection pooling using Cloud SQL Auth Proxy.

Question 12

Which TWO options are valid ways to connect an on-premises network to a VPC in Google Cloud? (Choose two.)

Accepted Answer

Cloud VPN.. Cloud VPN is a valid way to connect an on-premises network to a VPC in Google Cloud. It uses IPsec (IKEv1 or IKEv2) to create an encrypted tunnel over the public internet between your on-premises VPN gateway and a Cloud VPN gateway in your VPC. This allows secure communication between your on-premises resources and your VPC subnets, making it a standard hybrid connectivity option.

Answer

Cloud NAT.

Answer

VPC Network Peering.

Answer

Private Google Access.

Question 13

A company is migrating a legacy monolithic application to Google Cloud. The application runs on a single VM and uses a local MySQL database. The goal is to minimize changes to the application code while improving availability. Which strategy should the company use?

Accepted Answer

Lift and shift the VM to Compute Engine, and migrate the database to Cloud SQL with a failover replica.. It minimizes code changes by lifting the application VM to Compute Engine as-is, while migrating the local MySQL database to Cloud SQL with a failover replica. This improves availability through Cloud SQL's managed automatic failover to a standby replica in a different zone, without requiring application code changes to the database connection logic (the application can continue using the same MySQL protocol).

Answer

Use a managed instance group for the application VM and store the database on a persistent disk attached to the primary instance.

Answer

Re-architect the application into microservices and use Cloud Run for stateless components.

Answer

Containerize the application and deploy on Google Kubernetes Engine (GKE) with Cloud Spanner as the database.

Question 14

A company stores large amounts of data in Cloud Storage and wants to reduce costs. Which two actions should they take? (Choose two.)

Accepted Answer

Enable object versioning and configure lifecycle rules to delete noncurrent versions after 90 days.. Enabling object versioning and configuring lifecycle rules to delete noncurrent versions after 90 days directly reduces storage costs by automatically removing older object versions that are no longer needed. Option D is correct because transitioning objects to Nearline or Coldline storage classes after 30 days leverages lower-cost storage tiers for infrequently accessed data, aligning cost with access patterns.

Answer

Disable object versioning to prevent multiple versions.

Answer

Add bucket labels to track cost by department.

Answer

Change the default storage class to Standard for all buckets.

Question 15

A company runs a critical web application behind an external HTTPS load balancer. The backend consists of a managed instance group of Compute Engine instances. Users report intermittent 502 Bad Gateway errors. The load balancer logs show occasional health check failures for some instances. The instances have a custom health check endpoint that returns a 200 status code only if the application is fully healthy. The application logs do not show any errors, and CPU/memory usage on the instances is normal. What should be the first troubleshooting step to identify the root cause?

Accepted Answer

Check the application's logs on the instances to see why the health check endpoint sometimes returns non-200. The health check endpoint is custom and returns 200 only when the application is fully healthy. Since the instances show normal CPU/memory and application logs show no errors, the intermittent 502 errors and health check failures might be due to the health check endpoint itself returning non-200 sporadically. The first troubleshooting step is to examine the application logs on the instances to understand why the health check endpoint sometimes fails. This will pinpoint the specific condition causing the health check to fail. Option A is incorrect because a TCP check would not validate application health and could mask the problem. Option B is incorrect because increasing the interval and decreasing the unhealthy threshold would delay detection or make it more sensitive, not address the root cause. Option C is incorrect because adding instances does not fix the health check issue; it only spreads traffic if some instances are unhealthy.

Answer

Change the health check to a TCP check on the application's port

Answer

Increase the health check check interval and decrease the unhealthy threshold

Answer

Increase the number of instances in the managed instance group