Google PCA Practice Test 32 — 15 Questions

Question 1

A developer needs to securely store a database password that will be used by a Compute Engine instance. The password must be rotated automatically every 30 days. Which service should they use?

Accepted Answer

Secret Manager. Google Cloud Secret Manager is designed to store, manage, and rotate secrets such as database passwords, API keys, and certificates. It supports automatic rotation schedules via Pub/Sub notifications and Cloud Functions or Cloud Run, making it the correct choice for a password that must rotate every 30 days. Cloud KMS manages encryption keys, not application secrets.

Answer

Cloud KMS

Answer

Cloud Storage with encryption

Answer

Environment variables

Question 2

A developer wants to store a database password that is used by a Cloud Function. The password must be automatically rotated every 30 days and accessed securely without storing it in the source code. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is the GCP service purpose-built for storing, accessing, and rotating secrets like database passwords. It supports automatic rotation schedules (including 30-day intervals) via Cloud Functions or Pub/Sub notifications, and Cloud Functions can access secrets at runtime using the Secret Manager API with IAM controls, keeping credentials out of source code.

Answer

Cloud KMS

Answer

Cloud Runtime Configuration

Answer

Firestore

Question 3

A company uses Cloud Composer to manage Apache Airflow workflows. They want to optimize costs. Which practice is most effective?

Accepted Answer

Configure auto scaling for the Cloud Composer environment. Cloud Composer supports autoscaling for its workers, which dynamically adjusts the number of worker pods based on the Airflow task queue depth. This directly optimizes costs by scaling down during low-load periods and scaling up only when needed, avoiding over-provisioning.

Answer

Use preemptible VMs for Airflow schedulers

Answer

Replace Cloud Composer with Cloud Functions for all workflows

Answer

Use small machine types for all Composer components

Question 4

A company wants to minimize egress costs for data transferred between Compute Engine instances in the same region but different zones. What is the best practice?

Accepted Answer

Use internal IPs and ensure they are in the same VPC.. B is correct because data transfer between Compute Engine instances in the same region but different zones uses internal IP addresses within the same VPC, which incurs no egress costs. Google Cloud does not charge for traffic between instances using internal IPs within the same region, regardless of zone, as long as they are in the same VPC network. This is the most cost-effective approach for minimizing egress costs.

Answer

Use a VPN connection.

Answer

Use Cloud NAT.

Answer

Use external IPs for all instances.

Question 5

A company is using Cloud Storage to store sensitive data. They need to enforce that objects are deleted exactly 30 days after creation. Which object lifecycle rule should they configure?

Accepted Answer

Delete action with condition age: 30.. The 'Delete action with condition age: 30' directly instructs Cloud Storage to remove objects 30 days after their creation time. The 'age' condition is measured from the object's creation timestamp, which aligns perfectly with the requirement to delete objects exactly 30 days after creation.

Answer

AbortIncompleteMultipartUpload after 30 days.

Answer

Delete action with condition daysFromNonCurrentTime: 30.

Answer

SetStorageClass to Nearline after 30 days.

Question 6

A GKE cluster has a Horizontal Pod Autoscaler (HPA) configured for CPU utilization. The pods are not scaling up even though CPU usage is high. What could be the reason?

Accepted Answer

The pods do not have resource requests defined. HPA for CPU utilization calculates utilization as a percentage of the pod's CPU request, not of the node or a raw usage value. If pods have no resource requests defined, the HPA cannot compute a utilization percentage and will not scale, even when CPU usage is high. Defining CPU requests on the pods resolves this.

Answer

The cluster autoscaler is disabled

Answer

The HPA is configured with the wrong metric name

Answer

The node pool is out of capacity

Question 7

A company is using Cloud Load Balancing to distribute traffic to a managed instance group (MIG) of web servers. The web servers are currently running in us-central1. To improve availability, the company plans to add a second MIG in us-west1. What must be done to ensure traffic is automatically routed to the closest healthy backend?

Accepted Answer

Use a global external HTTP(S) load balancer and add both MIGs as backends.. A global external HTTP(S) load balancer can route traffic to backends in multiple regions and automatically directs requests to the closest healthy backend based on the client's geographic location and backend health. Adding both MIGs as backends to this single anycast IP ensures traffic is distributed to the nearest region without additional DNS-based routing or redirects.

Answer

Use a Network Load Balancer in us-central1 and configure a redirect to the new MIG.

Answer

Use an internal TCP/UDP load balancer in each region and configure DNS-based routing.

Answer

Use an external TCP/UDP Network Load Balancer with the new MIG as an additional backend.

Question 8

A company wants to set a monthly spending limit for their Compute Engine usage and receive alerts when spending exceeds a threshold. Which tool should they use?

Accepted Answer

Cloud Budget alerts. Budget alerts in Cloud Billing allow you to set a spending budget and receive notifications when actual spending exceeds thresholds. They can be scoped to projects or services.

Answer

Cloud Monitoring

Answer

Cloud Logging

Answer

Cloud Armor

Question 9

A company has a global web application deployed across multiple regions. They use an external HTTPS Load Balancer with backend services in us-central1 and europe-west1. They want users to be routed to the closest healthy backend. Which load balancing configuration is required?

Accepted Answer

External HTTPS Load Balancer with global backend. An External HTTPS Load Balancer with a global backend configuration uses Google Cloud's global anycast IP and the Premium Tier network to route users to the closest healthy backend based on latency and proximity. This setup ensures that traffic from users worldwide is directed to the nearest region (us-central1 or europe-west1) with a healthy instance group, providing optimal performance and failover.

Answer

Internal HTTP(S) Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

Classic Application Load Balancer

Answer

Regional external HTTPS Load Balancer

Question 10

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) clusters are signed by an authorized authority and only those images are allowed to run. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on GKE. It works by enforcing attestations that are created by authorized authorities after verifying the image's signature. This allows you to enforce that only images signed by an authorized authority are allowed to run.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Build

Answer

Artifact Registry

Question 11

A user runs the gsutil command shown in the exhibit and gets an AccessDenied error. The user is not authenticated with gcloud. What should the user do first?

Accepted Answer

Run gcloud auth login to authenticate with their Google account.. The error occurs because the user is not authenticated with gcloud. The gsutil command requires valid authentication credentials to access Google Cloud Storage resources. Running `gcloud auth login` initiates the OAuth 2.0 flow, which authenticates the user with their Google account and generates the access token that gsutil uses for API calls. This is the prerequisite step before any gsutil operation can succeed.

Answer

Create a service account and download a JSON key.

Answer

Grant public write access to the bucket.

Answer

Use gcloud config set project my-project to set the project.

Question 12

A company wants to use their existing Active Directory for authentication to Google Cloud. They need to sync user and group identities to Cloud Identity and allow users to log in with their corporate credentials. Which two services should they use together?

Accepted Answer

Cloud Directory Sync and SAML SSO. Cloud Directory Sync (CDS) syncs users and groups from LDAP/AD to Cloud Identity. SAML SSO allows users to authenticate using their corporate credentials. IAP is for application access, not directory sync. Cloud Identity as a standalone does not sync automatically. Workload Identity is for Kubernetes.

Answer

Cloud Directory Sync and Workload Identity

Answer

SAML SSO and IAP

Answer

Cloud Identity and IAP

Question 13

An organization needs to run a stateful application on Google Kubernetes Engine (GKE) where the nodes are fully managed by Google and the application workload SLAs are guaranteed. They want to minimize operational overhead. Which GKE mode should they use?

Accepted Answer

GKE Autopilot. GKE Autopilot manages the entire node infrastructure including node provisioning, scaling, and maintenance. It provides workload-level SLAs (e.g., 99.95% for pods). Standard mode requires the user to manage node pools.

Answer

GKE Standard with Cluster Autoscaler

Answer

GKE Standard with node auto-provisioning

Answer

GKE Standard with sole-tenant nodes

Question 14

A healthcare organization uses Cloud Storage to store protected health information (PHI). They have a compliance requirement to ensure that all objects in the bucket are encrypted with a customer-managed key (CMK) that is rotated every 90 days. They also need to log all access to the bucket and detect anomalous access patterns. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle. Cloud Storage with CMEK via Cloud KMS allows the organization to use a customer-managed key that can be rotated every 90 days, meeting the compliance requirement. Cloud Audit Logs capture all access to the bucket, and Chronicle provides advanced security analytics to detect anomalous access patterns, fulfilling the logging and detection needs.

Answer

Cloud Storage with default encryption, Cloud Audit Logs, and Security Command Center

Answer

Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud DLP

Answer

Cloud Storage with CSEK, Cloud Audit Logs, and Security Command Center

Question 15

A company monitors their application with Cloud Monitoring. They set up an alerting policy to notify the on-call team when the 99th percentile latency exceeds 500 ms for 5 minutes. However, they receive false positive alerts due to short bursts. How should they refine the policy?

Accepted Answer

Increase the evaluation window to 10 minutes.. Increasing the evaluation window to 10 minutes smooths out short bursts of high latency, ensuring the alert triggers only when the 99th percentile latency exceeds 500 ms for a sustained period. Cloud Monitoring evaluates metrics over the specified window, so a longer window reduces false positives from transient spikes while still detecting genuine degradation.

Answer

Set up alerting on each data point individually.

Answer

Decrease the threshold to 400 ms.

Answer

Change the metric to average latency instead of 99th percentile.