Google PCA Practice Test 33 — 15 Questions

Question 1

A company wants to automatically apply security patches to Compute Engine instances running Windows Server. They need a solution that can schedule patch installations and report compliance. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OS Config. OS Config (now part of VM Manager) provides patch management for Compute Engine instances, including Windows Server, with the ability to schedule patch jobs, define patch windows, and report compliance through the OS Config API and Cloud Console. It is the native Google Cloud service designed for OS patch deployment and compliance reporting across fleets of VMs.

Answer

Cloud Monitoring

Answer

Cloud Deploy

Answer

Cloud Build

Question 2

A company runs batch analytics workloads on Compute Engine that can tolerate interruptions. They want to reduce compute costs by up to 60-90%. Which compute option is the most cost-effective?

Accepted Answer

Preemptible VMs. Preemptible VMs are Google's spot-equivalent instances that can be terminated at any time when resources are needed elsewhere, and they offer discounts of up to 60-91% compared to on-demand pricing. Since the batch analytics workloads are explicitly described as interruption-tolerant, they are the ideal fit for preemptible VMs, which is why they deliver the greatest cost savings here.

Answer

On-demand VMs

Answer

Committed use discounts (1-year)

Answer

Sustained use discounts

Question 3

Refer to the exhibit. A developer is trying to connect to the Kubernetes API server from their workstation using the master IP (34.67.89.12) but receives a timeout. The developer can reach other external IPs. What is the most likely reason for the timeout?

Accepted Answer

The private cluster is configured with a private endpoint and public endpoint disabled, so the master IP is not accessible from outside the VPC.. A private GKE cluster with a private endpoint and public endpoint disabled means the Kubernetes API server is only reachable from within the cluster's VPC network. The developer's workstation is outside the VPC, so attempts to reach the master IP (34.67.89.12) will time out, even though other external IPs are reachable. This is a common configuration for security-sensitive workloads that require the API server to be isolated from the public internet.

Answer

The cluster is in a different region than the developer's VPC.

Answer

The developer's workstation does not have the required firewall rule to allow traffic to the master IP.

Answer

The Kubernetes Engine API is not enabled in the developer's project.

Question 4

Your team manages a service with a 99.9% uptime SLO over a 30-day window. The error budget for this period is 43 minutes. In the first week, outages consumed 30 minutes of the budget. You are planning a new release. What should you do?

Accepted Answer

Delay the release and focus on improving reliability to rebuild the error budget.. With only 13 minutes of error budget remaining after the first week, proceeding with the release (Option B) risks exhausting the budget entirely from any unforeseen issues, violating the 99.9% SLO. Delaying the release (Option C) allows the team to focus on reliability improvements, such as implementing canary deployments, adding circuit breakers, or enhancing monitoring with tools like Prometheus and Grafana, to rebuild the error budget over the remaining 23 days. This aligns with the principle of using error budgets to balance innovation with reliability, as defined in Google's SRE practices.

Answer

Reduce the SLO to 99.8% to increase the error budget.

Answer

Proceed with the release because the remaining budget is sufficient.

Answer

Release the feature but only to a small percentage of users.

Question 5

A company wants to give a new employee read-only access to all projects in their GCP organization. Which IAM role should they assign at the organization level to grant this access?

Accepted Answer

roles/viewer. The roles/viewer role grants read-only access to all resources within the organization, including all projects, making it the correct choice for a new employee who needs read-only access across all projects. Assigning it at the organization level ensures the permission is inherited by all projects, folders, and resources beneath. This follows the principle of least privilege for read-only access.

Answer

roles/owner

Answer

roles/editor

Answer

roles/orgadmin

Question 6

Which TWO options are valid ways to connect an on-premises network to a VPC in Google Cloud? (Choose two.)

Accepted Answer

Cloud VPN.. Cloud VPN is a valid way to connect an on-premises network to a VPC in Google Cloud. It uses IPsec (IKEv1 or IKEv2) to create an encrypted tunnel over the public internet between your on-premises VPN gateway and a Cloud VPN gateway in your VPC. This allows secure communication between your on-premises resources and your VPC subnets, making it a standard hybrid connectivity option.

Answer

Cloud NAT.

Answer

VPC Network Peering.

Answer

Private Google Access.

Question 7

A company is migrating 500 TB of on-premises file server data to Cloud Storage. The on-premises network has a 1 Gbps link to Google Cloud, but the migration must complete within 30 days. What is the MOST cost-effective and reliable method?

Accepted Answer

Use Transfer Appliance. Transfer Appliance is the most cost-effective and reliable method for migrating 500 TB over a 1 Gbps link within 30 days. At 1 Gbps, transferring 500 TB would take approximately 46 days (assuming ideal conditions), exceeding the 30-day deadline. Transfer Appliance physically ships the data, bypassing network bandwidth limitations and reducing transfer time to days.

Answer

Use Storage Transfer Service over a dedicated interconnect

Answer

Deploy a VPN and use gsutil rsync

Answer

Use Database Migration Service

Question 8

A company wants to encrypt data at rest in Cloud Storage using a key that they generate and manage themselves, not stored in Google Cloud. Which encryption type should they use?

Accepted Answer

CSEK. Customer-Supplied Encryption Keys (CSEK) allow you to provide your own AES-256 key with each Cloud Storage request; Google Cloud uses the key to encrypt/decrypt data but does not store the key. This matches the requirement of a self-generated, self-managed key not stored in Google Cloud. CMEK, by contrast, stores the key in Cloud KMS.

Answer

Default encryption

Answer

Cloud HSM

Answer

CMEK with Cloud KMS

Question 9

An application uses Cloud SQL (PostgreSQL) and experiences high connection overhead, often exhausting the max connections limit. The team wants to maintain a pool of persistent connections without modifying application code. Which solution should they implement?

Accepted Answer

Deploy PgBouncer on a Compute Engine instance. PgBouncer is a lightweight connection pooler that sits between the application and Cloud SQL, maintaining a pool of persistent connections and multiplexing many client connections onto a smaller number of database connections. This reduces connection overhead and prevents exhausting the max_connections limit without requiring application code changes. Cloud SQL Auth Proxy is for secure authentication, not pooling, and increasing max_connections only postpones the problem.

Answer

Use Cloud Memorystore as a connection cache

Answer

Increase the max connections flag in Cloud SQL

Answer

Configure Cloud SQL Auth Proxy with max connections

Question 10

A Cloud Run service needs to connect to a Cloud SQL MySQL instance privately without using public IP. What must be configured?

Accepted Answer

Deploy a VPC connector and attach it to the Cloud Run service. To connect a Cloud Run service to a Cloud SQL instance privately without using public IP, you must deploy a Serverless VPC Access connector and attach it to the Cloud Run service. This connector allows Cloud Run to route traffic to the VPC network, where Cloud SQL's private IP resides. The connection uses the VPC's internal IP range, ensuring private communication.

Answer

Set up VPC Network Peering between Cloud Run and Cloud SQL

Answer

Enable Private Google Access on the VPC subnet

Answer

Use Cloud SQL Proxy as a sidecar container

Question 11

A developer ran the above command to create a health check for a backend service. Which of the following should they do to resolve the error?

Accepted Answer

Use a different name for the health check.. The error indicates that a health check with the same name already exists. In Google Cloud, health check names must be unique within a project (or within a region for regional health checks). By using a different name, the developer can create a new health check without conflicting with the existing one.

Answer

Change the request-path to a different value.

Answer

Delete the existing health check and recreate it.

Answer

Add the --global flag to the command.

Answer

Use --load-balancer-type internal to create a new health check with the same name.

Question 12

Your company runs a stateless web application on Compute Engine. You want to ensure that if a zone fails, the application continues to serve traffic with minimal manual intervention. What should you do?

Accepted Answer

Create a regional managed instance group with an autoscaling policy and use a global Cloud Load Balancer.. A regional managed instance group (MIG) distributes instances across multiple zones within a region, ensuring that if one zone fails, the remaining zones continue serving traffic. Combined with a global Cloud Load Balancer, traffic is automatically routed to healthy instances in any zone, providing high availability with minimal manual intervention. Autoscaling further ensures that new instances are created to handle load, even if a zone becomes unavailable.

Answer

Schedule regular snapshots of each instance's persistent disk to a regional bucket.

Answer

Use a global Cloud Load Balancer and enable Cloud CDN.

Answer

Create an instance template and manually deploy instances in another zone.

Question 13

A developer is using Cloud Build to automate deployments. The build fails with an error: 'Permission 'iam.serviceAccounts.actAs' denied.' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Service Account User role on the service account used in the build steps. The error 'Permission iam.serviceAccounts.actAs denied' occurs when a Cloud Build build step tries to impersonate a service account (e.g., to deploy resources) but the Cloud Build service account lacks the Service Account User role on that target service account. Option D correctly identifies that the Cloud Build service account does not have the `roles/iam.serviceAccountUser` role on the service account used in the build steps, which is required to delegate access.

Answer

The developer does not have iam.serviceAccounts.actAs permission on the project

Answer

The build configuration is missing a required step

Answer

The Cloud Build service account is not enabled

Question 14

Your team is following an incident management process. After resolving a major incident, you are tasked with conducting a postmortem. What is the PRIMARY goal of the postmortem process in Google Cloud's recommended approach?

Accepted Answer

Understand the root cause and implement changes to prevent recurrence. Google's recommended postmortem process, derived from SRE practices, is blameless and focused on learning: the primary goal is to understand the root cause(s) of the incident and implement systemic changes to prevent recurrence. It emphasizes identifying contributing factors across technology, process, and human dimensions rather than assigning fault. Documentation and communication are outputs, not the primary goal, and financial or punitive outcomes are explicitly excluded.

Answer

Document the incident timeline and communicate it to stakeholders

Answer

Calculate the financial impact and bill the responsible team

Answer

Identify the individual responsible for the incident and take corrective action

Question 15

A developer wants to allow a Compute Engine VM to authenticate to Google Cloud APIs without embedding service account keys in the VM image. What is the recommended approach?

Accepted Answer

Attach a service account to the VM instance. Attaching a service account to a Compute Engine VM instance is the recommended approach because it provides the VM with automatically rotated, short-lived credentials via the metadata server. Applications on the VM can call the metadata server to obtain access tokens without any key files. This eliminates the risk of key leakage and manual rotation.

Answer

Use Cloud KMS to encrypt a service account key and store it in a bucket

Answer

Use a service account impersonation flow

Answer

Create a service account key and store it in the VM's startup script