Google PCA Practice Test 35 — 15 Questions

Question 1

Your organization operates a multi-project Google Cloud environment. A security team requires that any new Compute Engine instance created in the production folder must have OS Login enabled and must not use project-wide SSH keys. You want to enforce this centrally with the least operational overhead and ensure that non-compliant creation attempts are denied. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Organization Policy constraint for compute.requireOsLogin and compute.disableProjectSshKeys, and apply them at the production folder.. Organization Policy constraints applied at the folder level enforce configuration rules across all descendant projects. compute.requireOsLogin forces OS Login for instances, and compute.disableProjectSshKeys blocks adding project-wide SSH keys. Applying both at the production folder denies non-compliant creation centrally with minimal operational overhead, unlike audits or IAM restrictions that do not enforce the desired configuration.

Answer

Create an Organization Policy constraint for compute.requireOsLogin and compute.skipDefaultNetworkCreation, and apply it at the production folder.

Answer

Apply a custom IAM deny policy on compute.instances.create for all principals except the security team, and require them to create instances on behalf of others.

Answer

Grant the security team the Compute Security Admin role and schedule a Cloud Scheduler job that audits instances with project-wide SSH keys.

Question 2

A financial analytics firm is deploying a new batch reporting platform on Google Cloud. The platform runs on a Managed Instance Group (MIG) of Compute Engine VMs and reads source data from a single Cloud Storage bucket. The security team requires that the VMs access the bucket without using long-lived service account keys, and that the identity be scoped specifically to this workload. They also want the permission to be automatically revoked when the VMs are deleted. Which approach should you recommend?

Accepted Answer

Create a dedicated service account, grant it roles/storage.objectViewer on the bucket, and attach it to the MIG as the instance service account.. Workload-scoped, keyless authentication on Compute Engine is achieved by attaching a dedicated service account to the instance template used by the MIG. The metadata server issues short-lived tokens to the application, so no static keys exist to leak or rotate, and the identity disappears with the instances. Granting only roles/storage.objectViewer on the specific bucket enforces least privilege for the reporting workload.

Answer

Use the Compute Engine default service account, which already has the Editor role, and add an IAM condition limiting access to the reporting project.

Answer

Enable Cloud Storage public access prevention and make the bucket readable by allAuthenticatedUsers, then restrict network access with VPC firewall rules.

Answer

Create a service account, generate a JSON key, store it in Secret Manager, and have the application mount it at runtime.

Question 3

Your company wants to implement a canary deployment for a microservice running on GKE. You need to gradually shift traffic from the stable version to the canary version while monitoring error rates. Which THREE components or practices should you use? (Choose 3)

Accepted Answer

Cloud Deploy with an automated canary strategy and verification. Option A is correct because Cloud Deploy natively supports canary deployment strategies with configurable phases (for example, 50% then 100%) and automated verification that can advance or halt a rollout based on analysis results. Option B is correct because Cloud Monitoring collects the error-rate metrics (such as HTTP 5xx ratios from the service) that Cloud Deploy's verification step or alerting policies use to detect failures and trigger a rollback. Option E is correct because Istio on GKE provides fine-grained traffic splitting via VirtualService weights, letting you shift a precise percentage of requests from the stable to the canary version while observing behavior. Option C is not appropriate because Cloud CDN caches responses at the edge and does not perform version-based traffic shifting or canary analysis. Option D is not appropriate because feature flags toggle functionality inside a single deployed version and do not by themselves implement gradual traffic shifting between two separately deployed versions.

Answer

Cloud CDN for caching responses

Answer

Feature flags in the application code

Question 4

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) using a Deployment into the correct order.

Accepted Answer

Build the container image, then push the image to a registry, then create a Deployment manifest, then apply the Deployment to the cluster, then create a Service to expose the application.. The image must be in a registry before the Deployment can reference it. The Service provides external access.

Answer

Build the container image, then push the image to a registry, then create a Service, then create a Deployment manifest, then apply the Deployment.

Answer

Build the container image, then create a Deployment manifest, then push the image to a registry, then apply the Deployment, then create a Service.

Answer

Create a Deployment manifest, then apply the Deployment, then build the container image, then push the image to a registry, then create a Service.

Question 5

A team wants to deploy a microservice on Cloud Run that needs to access a Cloud Memorystore for Redis instance in the same region. The Redis instance is in a VPC network. Which configuration is required for Cloud Run to reach the Redis instance?

Accepted Answer

Create a Serverless VPC Access connector and configure Cloud Run to use it. Cloud Run is serverless and runs outside the customer VPC by default. To reach a Memorystore Redis instance inside a VPC, you must create a Serverless VPC Access connector and attach it to the Cloud Run service, enabling egress to the VPC. This provides private IP connectivity to Redis.

Answer

Configure a Cloud NAT gateway

Answer

Use Private Google Access

Answer

Deploy Cloud Run within a VPC

Question 6

A company runs a web application on GKE and wants to expose it to the internet using a global HTTP(S) load balancer with Cloud CDN. Which TWO GCP resources are required to configure this setup? (Choose TWO.)

Accepted Answer

Kubernetes Ingress resource with a GCE ingress controller. Option A is correct because a Kubernetes Ingress resource managed by the GCE ingress controller is what triggers GKE to provision a global external HTTP(S) load balancer and wire it to the application's Service; the ingress annotations (e.g., kubernetes.io/ingress.class: gce) and BackendConfig enable Cloud CDN on the resulting backend. Option C is correct because the global HTTP(S) load balancer requires a backend service that defines the instance groups/NEGs and a health check to determine which backends are healthy and eligible to receive traffic. Option B is not needed because Cloud NAT provides outbound internet access for private instances, not inbound load balancing. Option D is not required because a ClusterIP Service is sufficient as the Ingress backend; a Service of type LoadBalancer would instead provision a separate network load balancer and is not how GCE Ingress exposes apps. Option E is not relevant because Cloud VPN provides encrypted connectivity between networks, not internet-facing HTTP(S) load balancing.

Answer

Cloud NAT gateway

Answer

A Kubernetes Service of type LoadBalancer

Answer

Cloud VPN tunnel

Question 7

An organization wants to use VPC Service Controls to protect a Cloud Storage bucket and a BigQuery dataset from data exfiltration. They want to allow access from a specific on-premises network via a Cloud VPN. Which TWO components are required? (Choose 2)

Accepted Answer

A service perimeter that includes the Cloud Storage bucket and BigQuery dataset. Option A is correct because a service perimeter is the fundamental VPC Service Controls construct that defines the boundary around protected resources; the Cloud Storage bucket and BigQuery dataset must be enclosed within the perimeter for VPC Service Controls to restrict access to them and prevent data exfiltration. Option B is correct because access levels define the conditions under which requests from outside the perimeter are allowed; to permit the specific on-premises network, an access level must include that network's IP range (CIDR), which is then bound to the perimeter via ingress rules. Option C is not required because Cloud VPN already provides the connectivity; Cloud Interconnect is an alternative dedicated/partner connection and is not mandated by VPC Service Controls. Option D is not required because VPC firewall rules govern VM-level traffic and do not control access to Google APIs protected by VPC Service Controls. Option E is not required because Private Google Access only affects how VMs reach Google APIs internally and is unrelated to authorizing on-premises access through a service perimeter.

Answer

Cloud Interconnect (Dedicated or Partner)

Answer

VPC firewall rules allowing traffic from on-premises

Answer

Private Google Access enabled on the VPC subnet

Question 8

You need to automatically roll back a GKE deployment if a new version causes a spike in 5xx errors. The deployment uses a canary strategy with Istio traffic splitting. What should you do?

Accepted Answer

Use Cloud Monitoring to watch the canary's error rate and trigger a Cloud Function that updates the Istio VirtualService to route all traffic back to the stable version.. The correct pattern is to monitor the canary's error rate with Cloud Monitoring (using Istio's telemetry metrics like istio_requests_total filtered by response_code=5xx and destination_version=canary), then use an alerting policy to trigger a Cloud Function (or Cloud Run) that patches the Istio VirtualService to shift 100% of traffic back to the stable version. This closes the loop between observability and traffic control, which is exactly what automated canary rollback requires.

Answer

Set the canary's traffic weight to 0 in the Istio VirtualService if errors exceed threshold using a Kubernetes Job.

Answer

Use GKE's built-in auto-repair feature to replace unhealthy pods.

Answer

Configure an Istio VirtualService with a retry policy that automatically redirects traffic on errors.

Question 9

A financial services company must comply with PCI DSS. They use Cloud SQL for MySQL for transaction processing. They need to ensure that all data at rest is encrypted with keys generated and stored in a Hardware Security Module (HSM) and that key rotation occurs every 90 days. Which configuration should they use?

Accepted Answer

Use Cloud SQL with CMEK backed by Cloud HSM, and set automatic rotation period of 90 days. Cloud SQL with CMEK backed by Cloud HSM meets the requirement for keys generated and stored in an HSM, and Cloud HSM supports automatic key rotation with a configurable period, including 90 days. CMEK allows you to manage and rotate the key used to encrypt data at rest, while Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key storage. The automatic rotation period can be set to 90 days via the key rotation policy in Cloud KMS, satisfying the compliance mandate.

Answer

Use Cloud External Key Manager (EKM) to integrate with on-premises HSM

Answer

Use Cloud SQL with customer-supplied encryption keys (CSEK) and automate rotation with Cloud Scheduler

Answer

Use Cloud SQL's default encryption with organization policy requiring rotation

Question 10

A company wants to use Customer-Managed Encryption Keys (CMEK) for data at rest in Cloud Storage, but also needs to ensure that the keys are stored in a hardware security module (HSM) to meet compliance requirements. Which Cloud KMS key type should they choose?

Accepted Answer

Cloud HSM key. Cloud HSM keys in Cloud KMS are backed by a FIPS 140-2 Level 3 validated hardware security module, satisfying compliance requirements that mandate HSM-backed key storage. This is the only Cloud KMS key type that provides hardware-backed protection while remaining fully managed within Google Cloud.

Answer

Predefined key

Answer

External key (Cloud External Key Manager)

Answer

Software-backed key

Question 11

A security team wants to receive alerts when a user attempts to grant the 'roles/owner' role to a member outside of the organization's domain. Which log filter should they use to create a log-based metric?

Accepted Answer

Filter on Admin Activity log type with 'protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND NOT protoPayload.request.policy.bindings: member: "example.com"'.. It uses the Admin Activity audit log type, which captures IAM policy changes, and filters for the SetIamPolicy method on the cloudresourcemanager service. The condition NOT protoPayload.request.policy.bindings: member: "example.com" ensures alerts are triggered only when the owner role is granted to a member outside the organization's domain, matching the security requirement exactly.

Answer

Filter on Data Access log type with 'protoPayload.methodName="google.iam.v1.IAMPolicy.SetIamPolicy"'.

Answer

Filter on Admin Activity logs for 'resource.type="gce_instance" AND protoPayload.methodName="compute.instances.setServiceAccount"'.

Answer

Filter on System Event logs with a query for 'resource.type="project" AND protoPayload.response.status.code=7'.

Question 12

A company runs a global application that requires strong consistency across regions for financial transactions. Which database should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is a globally distributed, strongly consistent database service that provides ACID transactions across regions. It is designed for applications that require strong consistency and high availability across multiple regions, making it ideal for financial transactions.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Firestore

Question 13

A developer wants to monitor a custom application metric from their application running on GKE. What should they use?

Accepted Answer

Cloud Monitoring custom metrics API. Cloud Monitoring custom metrics API (option D) is the correct choice because it allows a developer to push custom application-specific metrics (e.g., request latency, queue depth) from a GKE pod using the `custom.googleapis.com` metric domain. This integrates directly with Cloud Monitoring for alerting and dashboards, whereas Cloud Logging is for log data, not metrics.

Answer

Cloud Logging

Answer

Cloud Trace

Answer

Cloud Debugger

Question 14

You are running a Kubernetes cluster in GKE with the default node pool configuration shown in the exhibit. Your application requires high disk I/O performance. You notice that the application is experiencing high latency for disk operations. What is the most likely cause?

Accepted Answer

The default node pool uses pd-standard disks, which have low IOPS.. The default node pool in GKE uses pd-standard (standard persistent disk) which provides lower IOPS compared to pd-ssd. For applications requiring high disk I/O performance, pd-standard disks become a bottleneck, causing high latency. Upgrading to pd-ssd or using local SSDs would resolve this issue.

Answer

Node auto-repair is causing disk contention.

Answer

The OAuth scopes restrict disk access, causing high latency.

Answer

The machine type n1-standard-2 does not have enough CPU.

Question 15

An organization wants to monitor and alert on custom application metrics from a GKE cluster. They also need to view logs in real-time and create metrics from log content. Which two GCP services should they use? (Choose two.)

Accepted Answer

Cloud Monitoring. Cloud Monitoring (B) is correct because it is the GCP service that ingests custom application metrics, lets you build dashboards, and configure alerting policies on those metrics from GKE workloads. Cloud Logging (E) is correct because it collects and streams logs in real time, and its log-based metrics feature lets you create counter or distribution metrics directly from log content. Together they satisfy both requirements: metric monitoring/alerting and real-time log viewing with metrics derived from logs. Error Reporting (A) only aggregates and groups application errors, not general metrics or log-based metrics. Cloud Profiler (C) analyzes CPU and heap usage for performance profiling, not metric alerting or log viewing. Cloud Trace (D) captures distributed latency traces across services, which is unrelated to custom metric alerting or log-based metric creation.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Trace