Google PCA Practice Test 33 — 15 Questions

Question 1

A large enterprise is migrating its on-premises data warehouse to BigQuery. The current warehouse is 100 TB and uses complex ETL jobs that run on SQL Server Integration Services (SSIS). The team wants to minimize migration effort and maintain the same SQL logic for transformations. They plan to use BigQuery's standard SQL. They also need to schedule transformations and load data from multiple on-premises sources. Which approach should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud Composer (Airflow) to orchestrate SQL statements in BigQuery, and use Data Transfer Service for scheduled loads.. Cloud Composer (Airflow) can orchestrate BigQuery SQL statements, and Data Transfer Service handles scheduled loads from on-premises sources, minimizing code changes. Option A is incorrect because running SSIS on Compute Engine still requires managing virtual machines and does not leverage BigQuery's full capabilities. Option B is incorrect because rewriting SSIS packages as Dataflow pipelines using Apache Beam would require significant recoding. Option C is incorrect because Data Fusion is a data integration service for replicating and transforming data, but it does not directly replicate SSIS package logic.

Answer

Connect SSIS to BigQuery using ODBC and run SSIS packages in a VM on Compute Engine.

Answer

Rewrite SSIS packages as Dataflow pipelines using Apache Beam.

Answer

Use Data Fusion to replicate SSIS packages.

Question 2

A company wants to allow a Kubernetes pod in GKE to authenticate to Google Cloud APIs without storing service account keys in the cluster. Which three components need to be configured to enable Workload Identity? (Choose three.)

Accepted Answer

Google Cloud service account. Workload Identity requires: (1) a Google Cloud IAM service account (GCP SA), (2) a Kubernetes service account (KSA) annotated with the GCP SA email, and (3) an IAM policy binding between the KSA and GCP SA to allow impersonation.

Answer

Firewall rule to allow traffic to metadata server

Answer

Cloud NAT for outbound access

Question 3

Which THREE practices are recommended for organizing projects in a Google Cloud organization?

Accepted Answer

Use a separate project for each environment (e.g., development, staging, production).. Using separate projects for each environment (development, staging, production) enforces resource isolation, prevents accidental cross-environment changes, and allows independent IAM policies, billing, and quotas. This aligns with Google Cloud's recommended resource hierarchy best practices for managing lifecycle and security boundaries.

Answer

Create a separate project to hold organization policies.

Answer

Consolidate all production resources into a single project for simplicity.

Question 4

A company migrated their on-premises database to Cloud SQL and now experiences high latency for read-heavy workloads. How can they optimize performance?

Accepted Answer

Add read replicas.. Adding read replicas is the correct optimization because Cloud SQL read replicas offload read traffic from the primary instance, reducing latency for read-heavy workloads. Read replicas asynchronously replicate data from the primary using MySQL or PostgreSQL native replication, allowing queries to be distributed across multiple instances. This directly addresses the high latency by scaling read capacity horizontally without impacting write performance.

Answer

Switch to a higher machine type.

Answer

Enable automatic storage increase.

Answer

Use connection pooling.

Question 5

Your company runs a data pipeline on Google Cloud using Cloud Dataflow for streaming processing from Pub/Sub to BigQuery. The pipeline writes to a BigQuery table partitioned by day. The data is used for real-time dashboards. Recently, a spike in traffic caused the Dataflow pipeline to fall behind, and the dashboard displayed stale data. You need to design the pipeline to handle traffic spikes without data loss or long delays. The pipeline must be cost-efficient and use defaults where possible. Which solution should you implement?

Accepted Answer

Enable autoscaling in the Dataflow pipeline and use Streaming Engine to handle larger throughput. Enabling autoscaling in Dataflow allows the pipeline to dynamically adjust the number of workers based on the processing backlog, while Streaming Engine offloads the shuffle and state storage to Google-managed resources, reducing the impact of traffic spikes. This combination ensures the pipeline can scale up quickly to handle increased throughput without data loss or long delays, and it remains cost-efficient by scaling down when demand decreases.

Answer

Modify the pipeline to use a batch (non-streaming) approach, writing hourly batches from Pub/Sub to BigQuery

Answer

Create a Cloud Scheduler job that increases the number of Dataflow workers every 5 minutes based on Pub/Sub subscription backlog

Answer

Change the Dataflow worker machine type from n1-standard-4 to n1-highmem-8

Question 6

A financial services company runs a stateful backend service on Google Kubernetes Engine (GKE) using StatefulSets with Persistent Volumes. They observe that after a node failure, the pod is rescheduled on a different node but the Persistent Volume cannot be attached because it is still "released" and not "available". What is the most likely cause and solution?

Accepted Answer

The PersistentVolume has retain policy "Retain"; manually delete and recreate the volume.. When a PersistentVolume (PV) has a reclaim policy of 'Retain', after the PersistentVolumeClaim (PVC) is deleted, the PV enters a 'Released' state and is not automatically recycled for reuse. The underlying storage resource (e.g., a Compute Engine persistent disk) still exists but the PV cannot be re-attached until an administrator manually deletes the PV and recreates it, or edits the PV to remove the claim reference. This explains why the pod rescheduled on a new node cannot attach the volume.

Answer

The PersistentVolume has reclaim policy "Recycle"; it is not supported in GKE.

Answer

The PersistentVolumeClaim was not created with the correct storage class; recreate with reclaim policy "Delete".

Answer

The PersistentVolumeClaim's access mode is ReadWriteOnce, which prevents attachment to a new node; change to ReadWriteMany.

Answer

The PersistentVolume has reclaim policy "Retain" and the previous pod's volume attachment is not cleared; use a StatefulSet with volumeClaimTemplates and reclaim policy "Delete".

Question 7

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Answer

Cloud Spanner

Answer

BigQuery

Answer

Firestore

Question 8

A company uses Cloud Deploy for continuous delivery. They have a delivery pipeline with multiple targets: dev, staging, and prod. They want to require manual approval before deploying to prod. How should they configure this?

Accepted Answer

Configure an approval gate on the prod target in the delivery pipeline. Approval gates in Cloud Deploy are configured as phases within a delivery pipeline, where a required approval step blocks progression until manually approved.

Answer

Add a Cloud Build trigger that pauses and waits for approval

Answer

Use IAM conditions to restrict deployment to prod

Answer

Set up a Pub/Sub notification and a Cloud Function to approve

Question 9

A DevOps engineer notices that a GKE cluster has nodes that are frequently preempted. They want to reduce costs but maintain resilience. What should they do?

Accepted Answer

Use a regional cluster with multiple zones. A regional cluster with multiple zones distributes workloads across zones, so if nodes in one zone are preempted, the cluster remains resilient by using nodes in other zones. This reduces costs by allowing the use of preemptible VMs (which are cheaper) while maintaining high availability, as the cluster can tolerate zone-level failures. The key is that regional clusters provide a managed control plane and node distribution across zones, which is essential for resilience against preemption.

Answer

Use node auto-repair

Answer

Use preemptible VMs for all nodes

Answer

Use committed use discounts

Question 10

A company is deploying a web application on Google Kubernetes Engine (GKE) and needs to ensure that the application's service account can only pull images from a specific Container Registry repository. What is the best practice to enforce this?

Accepted Answer

Use Workload Identity and grant the Kubernetes service account's associated Google service account the roles/storage.objectViewer role on the registry bucket.. Workload Identity allows you to map a Kubernetes service account to a Google service account and grant that Google service account the roles/storage.objectViewer role on the specific Container Registry bucket. This ensures that only pods using that Kubernetes service account can pull images from the designated repository, following the principle of least privilege.

Answer

Grant the Compute Engine default service account the roles/storage.objectViewer role on the registry bucket.

Answer

Set an IAM policy on the pod directly using the 'gke-default' service account.

Answer

Create an IAM condition on the node pool's service account that limits access to the registry bucket.

Question 11

A team is designing a multi-tier web application on Compute Engine. They need to ensure that only the web tier can access the application tier over a specific port. They plan to use VPC firewall rules. Which approach minimizes the attack surface?

Accepted Answer

Allow ingress from the web tier's instances' service accounts to the application tier's instances. It uses service account-based firewall rules, which allow you to specify the source as the service account attached to the web tier's instances rather than their IP addresses or subnets. This ensures that only instances with that specific service account (i.e., the web tier) can reach the application tier on the designated port, regardless of their IP or subnet. By scoping access to a specific identity, you minimize the attack surface because no other instances, even those in the same subnet, can reach the application tier unless they also use that service account.

Answer

Allow ingress from any source to the application tier on the port

Answer

Allow ingress from the web tier's subnet to the application tier's instances on the port

Answer

Allow egress from the web tier to the application tier

Question 12

A media streaming company uses Google Cloud CDN to deliver content. They notice that users in certain regions experience high latency despite CDN caching. The content is dynamic based on user location (e.g., local news). What should they do to improve performance?

Accepted Answer

Deploy Cloud Run services in multiple regions and use a global external HTTPS load balancer with backend services to route requests to the nearest region. Deploying Cloud Run services in multiple regions and using a global external HTTPS load balancer with backend services enables location-based routing via the load balancer's anycast IP and backend service configuration. The load balancer automatically routes user requests to the nearest Cloud Run backend that has capacity, reducing latency for dynamic, location-specific content that cannot be effectively cached by Cloud CDN.

Answer

Use Cloud Functions with a regional HTTP trigger and Cloud CDN to cache the responses

Answer

Use Cloud Armor to route traffic to the nearest point of presence

Answer

Configure Cloud CDN to use cache keys based on user location headers

Question 13

A company uses Cloud Spanner for a global financial application. They need to ensure that a regional outage does not cause data loss. The application requires strong consistency and low latency reads and writes across multiple regions. Which configuration meets the reliability requirements?

Accepted Answer

Use a multi-region Spanner instance with a primary region and two witness regions. A multi-region Spanner instance with a primary region and two witness regions uses Google's synchronous replication across three regions, ensuring strong consistency and no data loss during a regional outage. Witness regions participate in the Paxos quorum without serving read traffic, guaranteeing that writes are committed in at least two regions before acknowledgment, which meets the requirement for zero data loss and low latency reads and writes.

Answer

Use a multi-region Spanner instance with read replicas in two other regions

Answer

Use a single-region Spanner instance and schedule backups to Cloud Storage

Answer

Use a single-region Spanner instance with point-in-time recovery (PITR) enabled

Question 14

An engineer is configuring Cloud Armor security policies for an HTTPS Load Balancer. They want to block requests from a specific IP range but allow all other traffic. What is the correct way to configure this?

Accepted Answer

Create a rule with priority 100 to deny the IP range, and a rule with priority 1000 to allow all traffic. Cloud Armor security policies use rules with a 'deny' action for blocking and 'allow' for permitting. Rules are evaluated in order of priority, with lower numbers having higher priority.

Answer

Create a rule with priority 1000 to allow all traffic, and a rule with priority 100 to deny the IP range

Answer

Create a single rule with the IP range and action 'deny'

Answer

Create a rule with priority 1000 to deny the IP range, and no allow rule

Question 15

An organization wants to use VPC Service Controls to protect a Cloud Storage bucket and a BigQuery dataset from data exfiltration. They want to allow access from a specific on-premises network via a Cloud VPN. Which TWO components are required? (Choose 2)

Accepted Answer

A service perimeter that includes the Cloud Storage bucket and BigQuery dataset. VPC Service Controls use access levels (often based on IP address) to allow or deny access. A service perimeter defines the protected resources. Cloud VPN provides the encrypted connection from on-premises. Cloud Interconnect is an alternative but not required. Private Google Access is for VMs in the VPC, not on-premises. VPC firewall rules do not apply to Google Cloud services.

Answer

Cloud Interconnect (Dedicated or Partner)

Answer

VPC firewall rules allowing traffic from on-premises

Answer

Private Google Access enabled on the VPC subnet