Google PCA Practice Test 34 — 15 Questions

Question 1

A company has a global web application deployed across multiple regions. They use an external HTTPS Load Balancer with backend services in us-central1 and europe-west1. They want users to be routed to the closest healthy backend. Which load balancing configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

External HTTPS Load Balancer with global backend. An External HTTPS Load Balancer with a global backend configuration uses Google Cloud's global anycast IP and the Premium Tier network to route users to the closest healthy backend based on latency and proximity. This setup ensures that traffic from users worldwide is directed to the nearest region (us-central1 or europe-west1) with a healthy instance group, providing optimal performance and failover.

Answer

Internal HTTP(S) Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

Classic Application Load Balancer

Answer

Regional external HTTPS Load Balancer

Question 2

Which THREE factors should be considered when selecting a machine series for a Compute Engine instance running a memory-intensive batch job?

Accepted Answer

Network throughput.. Network throughput (A) is a critical factor for a memory-intensive batch job because such jobs often involve reading or writing large datasets from persistent storage or other sources over the network. The instance series must provide sufficient network bandwidth to avoid I/O bottlenecks that could extend job completion time, even if the compute and memory resources are adequate.

Answer

Sustained use discount.

Answer

GPU availability.

Question 3

Which TWO IAM predefined roles grant read-only access to Cloud Storage objects but not the ability to list buckets?

Accepted Answer

roles/storage.legacyBucketReader. Roles/storage.legacyBucketReader, is correct because it grants read access to Cloud Storage objects (via the storage.objects.get permission) but does not include the storage.buckets.list permission, so users cannot list buckets. Option B, roles/storage.objectViewer, is correct because it provides read-only access to objects (storage.objects.get and storage.objects.list) without the ability to list buckets, as it lacks storage.buckets.list.

Answer

roles/storage.objectAdmin

Answer

roles/storage.viewer

Answer

roles/storage.admin

Question 4

A company is designing a VPC Service Controls perimeter to protect data stored in Google Cloud. They need to allow access from their on-premises network via a Cloud VPN tunnel while blocking all internet-based access. What is the most secure and manageable approach?

Accepted Answer

Configure a VPC Service Controls perimeter and create an access level that includes the on-premises CIDR range.. VPC Service Controls (VPC SC) is the only Google Cloud-native mechanism that can create a security perimeter around managed services (like Cloud Storage, BigQuery) and restrict access based on an access level that includes the on-premises CIDR range. This ensures that only traffic originating from the on-premises network (via the Cloud VPN tunnel) is allowed, while all internet-based access is blocked, even if the request uses valid credentials. Firewall rules alone cannot restrict access to Google-managed APIs, and Private Google Access does not enforce a perimeter around services.

Answer

Configure firewall rules to only allow traffic from the on-premises CIDR to the VPC.

Answer

Use Cloud VPN and Private Google Access to allow on-premises access without public IPs.

Answer

Use Cloud IAP (Identity-Aware Proxy) to restrict access based on identity and context.

Question 5

The exhibit shows the output of a 'gcloud compute instances describe' command for an instance. What is the most likely impact on reliability if the host machine needs maintenance?

Accepted Answer

The instance will be terminated and then restarted, causing a brief downtime.. When a host machine requires maintenance, Google Compute Engine instances that are not configured for live migration will be terminated and then restarted on another host. This behavior is determined by the 'onHostMaintenance' setting; if it is set to 'TERMINATE' (the default for instances with GPUs or preemptible VMs), the instance stops and restarts, causing brief downtime. The exhibit likely shows 'onHostMaintenance: TERMINATE' or the instance lacks live migration support, making termination and restart the expected outcome.

Answer

The instance will not be affected because automatic restart is enabled.

Answer

The instance will be backed up automatically before maintenance.

Answer

The instance will be live migrated to another host without interruption.

Question 6

A company runs a batch processing job that runs daily and can handle interruptions. The job runs on a single Compute Engine instance. Which machine configuration is the most cost-effective?

Accepted Answer

A preemptible n1-standard-4 VM. A preemptible VM costs significantly less than a standard VM (up to 80% discount) and is ideal for batch processing jobs that can handle interruptions. The job runs daily and can tolerate being stopped, so the lower cost of a preemptible instance provides the most cost-effective solution without sacrificing functionality.

Answer

A n2-standard-4 VM with sustained use discount

Answer

A standard n1-standard-4 VM

Answer

A n1-standard-4 VM with a GPU

Question 7

A data analytics team uses BigQuery to run large queries. They want to reduce query costs. Which three practices should they adopt? (Choose THREE.)

Accepted Answer

Use clustered tables on commonly filtered columns. Clustering tables on commonly filtered columns in BigQuery allows the query engine to prune blocks of data that don't match the filter, reducing the amount of data scanned and thus lowering query costs. This is especially effective when combined with partitioning, as it further narrows the scan to relevant clusters within a partition.

Answer

Use query caching

Answer

Always use SELECT * to ensure all columns are available

Question 8

Why did the VM resource fail while the disk succeeded?

Accepted Answer

The VM definition is missing a boot disk source reference.. When you define a VM instance in Google Cloud, you must include a reference to a boot disk source. If the `source` field under `disks` is missing or empty, the API will reject the VM creation but may still succeed in creating the disk resource separately, since the disk creation does not depend on the VM. This explains why the disk succeeded while the VM failed.

Answer

The disk and VM must be in the same zone; us-central1-a is consistent.

Answer

The VM's machine type is not available in us-central1-a.

Answer

The VM's network is misspelled as 'global/networks/default' instead of 'global/networks/default' (correct).

Question 9

Drag and drop the steps to set up a shared VPC in Google Cloud for a multi-project environment into the correct order.

Accepted Answer

Enable Shared VPC in the host project, then attach service projects, then grant IAM roles to service project users, then deploy resources in service projects.. The host project holds the VPC network. Service projects use the subnets. IAM roles control who can use the subnets.

Answer

Attach service projects to the host project, then enable Shared VPC in the host project, then grant IAM roles, then deploy resources.

Answer

Enable Shared VPC in the host project, then grant IAM roles to service project users, then attach service projects, then deploy resources.

Answer

Enable Shared VPC in the host project, then attach service projects, then deploy resources in service projects, then grant IAM roles.

Question 10

A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a GCP service account with appropriate IAM roles. Workload Identity allows binding a Kubernetes service account to a GCP service account. Then, IAM can be granted to that GCP service account for the Cloud Storage bucket.

Answer

Use VPC Service Controls to restrict the bucket to only the GKE cluster's VPC

Answer

Use firewall rules to allow traffic only from the GKE cluster's pod CIDR

Answer

Use Cloud Armor to restrict access based on source IP

Question 11

An organization is migrating a MySQL database to Cloud SQL. They require automatic failover with zero data loss in the event of a zone outage. Which configuration should they use?

Accepted Answer

Cloud SQL with high availability (HA) configuration.. Cloud SQL's high availability (HA) configuration uses a synchronous write to a standby instance in a different zone within the same region. This ensures that every transaction committed on the primary is also committed on the standby before acknowledging the client, guaranteeing zero data loss during a zone outage. Automatic failover to the standby occurs with no manual intervention, meeting both the automatic failover and zero data loss requirements.

Answer

Cloud SQL with a cross-region replica.

Answer

Cloud SQL with automated backups and binary logging.

Answer

Cloud SQL with a read replica in a different zone.

Question 12

An organization uses Cloud Spanner with a multi-region configuration to achieve 99.999% availability for their global user base. They notice an increase in write latency during peak hours. Which action would MOST effectively reduce write latency?

Accepted Answer

Add more nodes to the Spanner instance. In Cloud Spanner, write latency can be reduced by adding more nodes (increasing throughput) or optimizing schema. Adding nodes provides more compute and I/O capacity, reducing queuing and latency.

Answer

Use a stronger read consistency level

Answer

Change from a multi-region to a single-region configuration

Answer

Enable follower reads

Question 13

A company is migrating a monolithic application to microservices on Google Cloud. They need to manage service-to-service authentication and authorization. Which service should they use?

Accepted Answer

Service Mesh (Anthos). Service Mesh (Anthos) provides a dedicated infrastructure layer for managing service-to-service communication, including mutual TLS (mTLS) authentication, fine-grained authorization policies, and observability. It uses sidecar proxies (Envoy) to intercept traffic and enforce security policies without modifying application code, making it ideal for microservices authentication and authorization.

Answer

Cloud NAT

Answer

Cloud Identity-Aware Proxy

Answer

Cloud Endpoints

Question 14

A company needs to run batch processing jobs that can tolerate interruptions. They want to minimize costs. Which TWO compute options should they consider? (Choose TWO.)

Accepted Answer

Preemptible VMs. Preemptible VMs and Spot VMs are short-lived, low-cost instances that can be terminated at any time. They are ideal for fault-tolerant batch jobs. Committed use discounts are for predictable workloads, not for interruptible jobs. Standard VMs and Sole-tenant nodes are more expensive and not intended for interruptible workloads.

Answer

Sole-tenant nodes

Answer

Committed use discounts

Answer

Standard (on-demand) VMs

Question 15

Your company runs a customer-facing API on Cloud Run with a concurrency setting of 80. The API calls a backend Cloud Function that performs a heavy computation (2–5 seconds). During peak hours, the API experiences increased latency and some requests time out after 60 seconds. Monitoring shows that the Cloud Run max instances is set to 100, and the Cloud Function max instances is set to 10. The timeout for Cloud Run is set to 300 seconds. The Cloud Function's timeout is set to 540 seconds. You need to reduce end-to-end latency and prevent timeouts while minimizing cost. Which action is most effective?

Accepted Answer

Increase Cloud Function max instances from 10 to 100. The bottleneck is the Cloud Function's low max instances (10), causing queuing. Increasing Cloud Function max instances allows more concurrent requests to be processed, reducing latency and timeouts. Option A is wrong because concurrency on Cloud Run is separate from backend; reducing concurrency would require more Cloud Run containers and increase cost. Option B is wrong because increasing Cloud Run max instances alone doesn't help if Cloud Function capacity is the limit. Option D is wrong because increasing Cloud Run timeout doesn't reduce latency; it just keeps the connection alive longer.

Answer

Increase Cloud Run max instances from 100 to 500

Answer

Increase Cloud Run request timeout from 300 to 600 seconds

Answer

Reduce Cloud Run concurrency from 80 to 10