Google PCA Practice Test 34 — 15 Questions

Question 1

A company wants to centrally manage firewall rules for all projects in an organization using hierarchical firewall policies. Which three resources can be used in conjunction with hierarchical firewall policies? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Organization node. Hierarchical firewall policies in Google Cloud are attached at nodes of the resource hierarchy, and the three valid attachment points are the organization node (B), folders (E), and projects (C). Option B is correct because an organization-level policy applies to all resources beneath the organization and serves as the topmost layer of hierarchical firewall rules. Option E is correct because folders sit between the organization and projects, allowing policies to be scoped to a subset of projects within the hierarchy. Option C is correct because a project-level policy applies to that project's resources and is evaluated after organization and folder policies. Options A and D are not valid attachment points: a Compute Engine instance (A) is a compute resource governed by the policies, not a node where a hierarchical firewall policy is attached, and a VPC network (D) is associated with VPC firewall rules, not hierarchical firewall policies.

Answer

Compute Engine instance

Answer

VPC network

Question 2

An organization wants to ensure that only container images signed by an authorized CI/CD pipeline can be deployed to their GKE clusters. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization is the GCP service that enforces deploy-time attestation, ensuring that only container images signed by trusted authorities (such as an authorized CI/CD pipeline) can be deployed to GKE clusters. It uses attestors and attestations created via Container Analysis, and policies can be set to allow only images with valid attestations. This directly satisfies the requirement to restrict deployments to pipeline-signed images.

Answer

Artifact Registry

Answer

Cloud Security Scanner

Answer

Cloud Build

Question 3

A company needs to encrypt data at rest in Cloud Storage using their own keys. They require that the keys are stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which key management option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud HSM. CMEK with Cloud HSM is correct because it lets the customer own and control the key while the key material is generated, stored, and used inside a FIPS 140-2 Level 3 validated hardware security module managed by Google Cloud. This satisfies both the 'customer-managed keys' requirement and the explicit HSM/FIPS 140-2 Level 3 mandate. Cloud KMS software keys (option D) are FIPS 140-2 Level 1/2 only, so they fail the HSM requirement.

Answer

Google-managed encryption keys

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS

Question 4

A financial services company must store customer data in a GCP region that is certified for FedRAMP High. They also need to ensure that only authorized personnel can access the data, and that access logs are kept for 10 years. Which combination of services meets these requirements?

Accepted Answer

Assured Workloads with Cloud Audit Logs and IAM. Assured Workloads is the GCP service designed to enforce regulatory compliance frameworks such as FedRAMP High by applying policy controls, restricting data residency to compliant regions, and enforcing personnel access controls (including support access restrictions). Combining it with Cloud Audit Logs (for the 10-year retention requirement via log sinks to a long-term bucket) and IAM (for least-privilege access) directly satisfies all three stated requirements.

Answer

Cloud HSM and Cloud Audit Logs

Answer

VPC Service Controls with Cloud DLP

Answer

Cloud KMS with CMEK and Cloud Audit Logs

Question 5

A DevOps engineer needs to grant a CI/CD pipeline (running in a different Google Cloud project) the ability to deploy resources into a target project. The pipeline uses a service account. What is the best way to grant this access?

Accepted Answer

Add the service account email as a member of the target project with appropriate roles.. Cross-project IAM access in Google Cloud is granted by adding the service account's email as a principal (member) on the target project and binding it to the required roles. IAM is global and project-scoped, so the pipeline's service account in Project A can be granted roles/editor or specific deploy roles in Project B without any network-level configuration. This is the canonical, least-privilege approach for CI/CD cross-project deployments.

Answer

Use VPC peering to allow cross-project access.

Answer

Use Cloud NAT to enable communication.

Answer

Create a new service account in the target project and share the key with the pipeline.

Question 6

A company with multiple projects must ensure that no data can be exfiltrated from a specific project's Cloud Storage buckets to unauthorized locations outside the organization. They also need to allow access only from a corporate VPN IP range. Which configuration meets these requirements?

Accepted Answer

Configure a VPC Service Controls perimeter with an access level restricted to the corporate VPN IP range.. VPC Service Controls creates a security perimeter around Google Cloud services (including Cloud Storage) that prevents data exfiltration by blocking access from outside the perimeter, even if IAM permissions would otherwise allow it. Access levels within the perimeter can be restricted to specific IP ranges (such as the corporate VPN CIDR), so only requests originating from those IPs can reach the protected resources. This combination of perimeter + access level directly satisfies both requirements: preventing exfiltration to unauthorized locations and limiting access to the VPN range.

Answer

Set firewall rules to block all traffic except from the VPN.

Answer

Use IAM conditions to restrict access based on IP address.

Answer

Use Cloud Armor with IP whitelisting.

Question 7

A team manages a GKE cluster with node pools using different machine types. They plan to upgrade the cluster to a new Kubernetes version. What is the safest upgrade strategy to minimize application downtime?

Accepted Answer

Use a surge upgrade to add new nodes before removing old ones.. A surge upgrade in GKE adds new nodes with the desired Kubernetes version before removing old nodes, ensuring capacity is maintained throughout the process. This minimizes application downtime by allowing pods to be rescheduled onto new nodes before old nodes are drained, following a controlled rolling update pattern that respects PodDisruptionBudgets.

Answer

Perform a rolling upgrade by draining all nodes simultaneously.

Answer

Create a new cluster with the desired version and migrate workloads.

Answer

Upgrade the node pool configuration one by one.

Question 8

A company wants to enforce that all API calls to GCP services from outside their corporate network come through a specific Cloud VPN tunnel. Which GCP service can enforce this policy?

Accepted Answer

VPC Service Controls. VPC Service Controls lets you define a service perimeter around GCP resources (such as Cloud Storage, BigQuery, and APIs) and restrict access so that requests must originate from within an authorized network — including a specific Cloud VPN tunnel or VPC network. By configuring an access level based on the VPN tunnel's source IP range or network, you can enforce that API calls to protected services from outside the corporate network are denied unless they traverse the specified VPN.

Answer

Cloud NAT

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 9

A company has Compute Engine instances in us-east1-a and us-east1-b zones. They want to allow communication between these instances with minimal latency and no additional cost. What is the best networking approach?

Accepted Answer

Use a single VPC network that includes both zones.. A single VPC network spans all regions and zones, allowing instances in different zones (us-east1-a and us-east1-b) to communicate using internal IP addresses with low latency and no additional cost. This is because VPC networks provide flat, global networking by default, and traffic between zones within the same VPC uses Google's internal backbone without incurring egress charges.

Answer

Configure VPC Network Peering between two separate VPC networks.

Answer

Create a new subnet in each zone and use Cloud NAT.

Answer

Set up a Cloud VPN between the zones.

Question 10

A company is migrating its on-premises MongoDB database to Google Cloud. They want a fully managed, highly available NoSQL database that is compatible with MongoDB drivers. Which Google Cloud service should they choose?

Accepted Answer

MongoDB Atlas on Google Cloud Marketplace. MongoDB Atlas on Google Cloud Marketplace is the correct choice because it is a fully managed MongoDB service that is wire-protocol compatible with native MongoDB drivers, allowing the company to migrate its on-premises MongoDB workload with minimal application changes. It provides high availability, automated backups, and scaling while running on Google Cloud infrastructure.

Answer

Cloud Firestore

Answer

Cloud Bigtable

Answer

Cloud SQL

Question 11

Your company runs a customer-facing API on Cloud Run with a concurrency setting of 80. The API calls a backend Cloud Function that performs a heavy computation (2–5 seconds). During peak hours, the API experiences increased latency and some requests time out after 60 seconds. Monitoring shows that the Cloud Run max instances is set to 100, and the Cloud Function max instances is set to 10. The timeout for Cloud Run is set to 300 seconds. The Cloud Function's timeout is set to 540 seconds. You need to reduce end-to-end latency and prevent timeouts while minimizing cost. Which action is most effective?

Accepted Answer

Increase Cloud Function max instances from 10 to 100. The bottleneck is the Cloud Function's low max instances (10), causing queuing. Increasing Cloud Function max instances allows more concurrent requests to be processed, reducing latency and timeouts. Option A is wrong because concurrency on Cloud Run is separate from backend; reducing concurrency would require more Cloud Run containers and increase cost. Option B is wrong because increasing Cloud Run max instances alone doesn't help if Cloud Function capacity is the limit. Option D is wrong because increasing Cloud Run timeout doesn't reduce latency; it just keeps the connection alive longer.

Answer

Increase Cloud Run max instances from 100 to 500

Answer

Increase Cloud Run request timeout from 300 to 600 seconds

Answer

Reduce Cloud Run concurrency from 80 to 10

Question 12

A company wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific Cloud KMS key can be read. Which approach should they use?

Accepted Answer

Enable Key Access Justifications on the Cloud KMS key and allow access only for justified requests.. To restrict access to a Cloud Storage bucket so that only objects encrypted with a specific Cloud KMS key can be read, the company should enable Key Access Justifications (KAJ) on the Cloud KMS key and allow access only for justified requests. KAJ provides the ability to enforce access policies based on the justification provided for a key operation, effectively tying object access to the specific key. Option B is incorrect because Cloud Storage bucket policies do not support conditions on `request.object.encryption.type`; that attribute is not a valid IAM condition for Cloud Storage. Option C is incorrect because `resource.hasTag` is not a valid IAM condition attribute for Cloud Storage objects. Option D is incorrect because VPC Service Controls provide perimeter-based security but do not restrict access based on the encryption key of individual objects.

Answer

Set a bucket policy that denies access if the object's encryption type is not CMEK.

Answer

Use IAM conditions with the resource name condition 'resource.name.startsWith("projects/_/buckets/example-bucket/objects/")' and 'resource.hasTag("kmsKeyName", "projects/p/locations/l/keyRings/kr/cryptoKeys/ck")'.

Answer

Configure VPC Service Controls to include the bucket and the Cloud KMS key resource.

Question 13

A company runs batch machine learning training jobs that can be interrupted. They want to reduce compute costs. Which Compute Engine VM pricing model is MOST cost-effective?

Accepted Answer

Preemptible VMs. Preemptible VMs are the most cost-effective for interruptible batch ML training jobs because they offer up to 80% discount compared to standard VMs. They can be terminated at any time by Compute Engine, but since the jobs can be interrupted, this is acceptable. Other pricing models like sustained use discounts apply automatically to standard VMs but offer smaller discounts, and committed use discounts require a 1- or 3-year commitment, which may not be suitable for temporary or variable workloads.

Answer

Standard VMs

Answer

Sustained use discounts

Answer

Committed use discounts

Question 14

A company is migrating a monolithic application to Google Cloud. The application consists of a stateful service that writes to local disk and a stateless web server. They want to minimize changes to the code. Which architecture should they use?

Accepted Answer

Lift and shift to Compute Engine instances with persistent disks for stateful service. It represents a lift-and-shift migration that minimizes code changes by running the monolithic application on Compute Engine instances. The stateful service can use persistent disks for local disk writes, while the stateless web server runs on the same or separate instances, preserving the existing architecture without refactoring.

Answer

Run the entire application on Cloud Run and use Cloud Filestore for shared state

Answer

Use App Engine Flexible Environment for the web server and Cloud SQL for state

Answer

Refactor the application into microservices and deploy on GKE with StatefulSets

Question 15

A multinational retailer is planning its Google Cloud landing zone. Each of the company's business units must be able to create projects and manage billing independently, but the central platform team must retain the ability to enforce network and security guardrails across everything. The company also wants to minimize the number of distinct IAM policy bindings it maintains at the top of the hierarchy. Which two design choices should the architect make? (Choose two.)

Accepted Answer

Apply organization policies such as constraints on allowed resource locations and external IP addresses at the organization node so they are inherited by all folders and projects. Delegating project creation and billing to folder-level roles gives each business unit autonomy while keeping the grant in one place per unit. Applying organization policies at the organization node enforces network and security guardrails through inheritance, so the central team controls every descendant without per-project work. Together these choices satisfy autonomy, central control, and a small number of top-level IAM bindings.

Answer

Grant each business unit's administrators the Organization Administrator role so they can create projects anywhere in the hierarchy

Answer

Create every project directly under the organization node and attach a distinct billing account to each project for isolation

Answer

Use a shared VPC host project per business unit and grant the central team Compute Network Admin on each host project only