Google PCA Practice Test 36 — 15 Questions

Question 1

A company is migrating a monolithic application to Google Cloud. They want to minimize changes to the application code while taking advantage of Cloud Run for serverless containers. Which approach should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud Run by packaging the existing application as a container and listening on a web server.. Cloud Run can run any containerized application that listens on HTTP requests on port 8080. By packaging the existing monolithic application as a container and adding a lightweight web server (e.g., Express, Flask, or Nginx), the company can deploy it to Cloud Run with minimal code changes, leveraging serverless scaling and pay-per-use pricing without refactoring into microservices.

Answer

Deploy the application to App Engine standard environment with automatic scaling.

Answer

Lift and shift the application to Compute Engine instances behind a load balancer.

Answer

Refactor the application into microservices and deploy each as a separate Cloud Run service.

Question 2

A company uses Cloud SQL for MySQL for its transactional database. They need to ensure automatic failover in case of a zonal outage with minimal data loss. What configuration should they use?

Question 3

A healthcare analytics company stores protected health information in Cloud Storage buckets. Auditors require that data be encrypted with customer-managed encryption keys (CMEK) and that key usage be logged separately from data access. The security team wants the ability to revoke access to the data by disabling a single key without deleting the data. Which configuration should the architect recommend?

Accepted Answer

Create a Cloud KMS key ring and key in the same region as the bucket, set the bucket's default KMS key to that key, and enable Cloud KMS Data Access audit logs.. Customer-managed encryption keys in Cloud KMS let the organization control key lifecycle, and setting a bucket's default KMS key applies CMEK to every object automatically. Cloud KMS Data Access audit logs capture cryptographic operations independently of Cloud Storage access logs, meeting the separation requirement. Disabling the key version immediately makes objects unreadable, achieving revocation without deleting data, which is exactly the auditor's ask.

Answer

Enable Bucket Lock on the bucket and configure a retention policy, then use Google-managed keys with Object Lifecycle Management to transition objects to Coldline storage.

Answer

Use Google-managed encryption keys and enable Data Access audit logs on the bucket to record every object read and write.

Answer

Store the data in a Cloud Storage bucket encrypted with a customer-supplied encryption key (CSEK) and rotate the key by re-uploading all objects with a new key each quarter.

Question 4

A team is migrating a stateful application to GKE. The application requires persistent storage with ReadWriteMany (RWX) access across multiple pods. Which Kubernetes volume type should they use to meet this requirement on GKE?

Accepted Answer

Filestore. Filestore is Google Cloud's fully managed NFS file service, and the Filestore CSI driver on GKE exposes it as a ReadWriteMany (RWX) PersistentVolume that many pods can mount simultaneously. Persistent Disk is block storage attached to a single node, so it can only support ReadWriteOnce (RWO) or ReadOnlyMany (ROX), not RWX. Cloud Storage FUSE is object storage mounted as a filesystem and is not a native Kubernetes RWX volume type for stateful workloads.

Answer

Persistent Disk (Compute Engine persistent disks)

Answer

Cloud Storage FUSE

Answer

ConfigMap

Question 5

A retail company is designing a new order-processing system on Google Cloud. The system must expose a REST API that is reachable from the public internet over a custom hostname, must terminate TLS at the edge, and must route requests to different backend services based on URL path prefixes such as /orders and /inventory. The platform team wants a fully managed, globally distributed solution that scales automatically and does not require managing reverse-proxy VMs. Which Google Cloud component should they place in front of the backends?

Accepted Answer

Global external Application Load Balancer with a URL map and a Google-managed SSL certificate. The global external Application Load Balancer is the only listed option that combines managed edge TLS termination, custom hostname support through Google-managed certificates, and URL-map-based path routing to multiple backends. Because it is a fully managed global proxy, it scales automatically and removes the operational burden of running reverse-proxy VMs, satisfying both the functional and operational requirements.

Answer

Traffic Director with Envoy sidecars deployed on each backend instance

Answer

Regional external passthrough Network Load Balancer with backend services in two zones

Answer

Cloud CDN with a signed URL key attached directly to the backend instance groups

Question 6

A company uses Cloud Logging to monitor their application logs. They notice that some logs from their Compute Engine instances are missing. The instances have the required logging permission. What is the most likely cause?

Accepted Answer

The logging agent is not configured to send logs to Cloud Logging.. Compute Engine instances do not automatically send logs to Cloud Logging. They require the Cloud Logging agent (based on fluentd) to be installed and configured to forward logs. Even with correct IAM permissions, without the agent, logs will not be collected. Option B correctly identifies this missing agent as the most likely cause.

Answer

The log sink is not configured correctly.

Answer

The instances are using a custom image without the logging agent.

Answer

The log bucket is in a different project.

Answer

The log entries are being filtered by the exclusion filter.

Question 7

Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.

Accepted Answer

Step 1: Identify the backup, Step 2: Create a new Cloud SQL instance, Step 3: Restore the backup to the new instance, Step 4: Redirect applications to the new instance.. Restoring to an existing instance may overwrite data; best practice is to restore to a new instance.

Answer

Step 1: Identify the backup, Step 2: Restore the backup to the existing instance, Step 3: Verify the data, Step 4: Redirect applications if needed.

Answer

Step 1: Create a new Cloud SQL instance, Step 2: Identify the backup, Step 3: Restore the backup to the new instance, Step 4: Redirect applications.

Answer

Step 1: Identify the backup, Step 2: Redirect applications to a new instance, Step 3: Restore the backup to the new instance, Step 4: Verify the restoration.

Question 8

A company wants to store customer transaction logs for 7 years for compliance. The logs are accessed rarely but must be retrievable within 24 hours. Which storage option is most cost-effective?

Accepted Answer

Cloud Storage Archive class. Cloud Storage Archive class is the most cost-effective option for data that is accessed rarely and requires retrieval within 24 hours. Archive class offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of 12 hours, which comfortably meets the 24-hour requirement. This makes it ideal for long-term compliance retention of transaction logs that are infrequently accessed.

Answer

Cloud Storage Nearline class

Answer

Cloud Storage Coldline class

Answer

Cloud Storage Standard class

Question 9

A retail company runs a batch analytics workload on Compute Engine. Jobs run nightly, are fault-tolerant, and can be preempted. Finance wants to minimize compute cost while ensuring the jobs still complete each night. The jobs are managed by a Managed Instance Group (MIG) template that must stay within a single zone for data locality compliance. Which configuration should you recommend?

Accepted Answer

Create a zonal MIG with a spot VM instance template and set the autoscaler to scale based on CPU utilization.. Spot VMs offer the largest discount for fault-tolerant, preemptible workloads, and a zonal MIG preserves the single-zone data locality requirement. The autoscaler ensures the nightly job has enough instances to finish on time. Committed use and sustained use discounts target steady-state or long-running workloads, so they do not fit a short nightly batch window. The combination of spot VMs, zonal placement, and CPU-based autoscaling meets both the cost and compliance constraints.

Answer

Create a zonal MIG with E2 standard VMs and configure a sustained use discount to lower the price.

Answer

Create a regional MIG with committed use discounts applied to the template and scale across three zones.

Answer

Create a zonal MIG with custom machine types and use the committed use discount for one-year terms.

Question 10

A company runs a streaming data pipeline using Dataflow to process real-time data and insert into BigQuery. Recently, workers are frequently failing with out-of-memory errors and the pipeline latency is increasing. What should they do to resolve the issue?

Accepted Answer

Enable Dataflow Streaming Engine. Dataflow Streaming Engine offloads the streaming data processing state and shuffle data from worker memory to a backend service, reducing memory pressure on workers. This directly addresses out-of-memory errors and latency increases without requiring manual scaling or machine type changes. It is the recommended solution for streaming pipelines experiencing memory bottlenecks.

Answer

Increase the worker machine type and memory

Answer

Use Cloud Pub/Sub for buffering and then load into BigQuery in batches

Answer

Enable autoscaling and increase the maximum number of workers

Question 11

A company wants to provision multiple similar environments (dev, test, prod) with consistent networking configurations. Which approach is a best practice for infrastructure as code?

Accepted Answer

Use a single Terraform configuration with workspaces.. Terraform workspaces allow you to manage multiple distinct environments (e.g., dev, test, prod) from a single configuration by maintaining separate state files. This ensures consistent networking configurations across environments while avoiding duplication of code, which is a core best practice for infrastructure as code.

Answer

Use Ansible playbooks to run ad-hoc commands.

Answer

Run separate gcloud commands for each environment.

Answer

Use Cloud Deployment Manager templates with environment-specific parameters.

Question 12

A startup is building a mobile app backend that requires real-time data synchronization across multiple users. They need a fully managed, serverless NoSQL database that scales automatically and supports offline persistence. Which database should they choose?

Accepted Answer

Cloud Firestore. Cloud Firestore is a fully managed, serverless NoSQL document database that scales automatically and provides real-time synchronization and offline persistence through client SDKs. These features directly match the mobile app backend requirements for real-time sync across users and offline support.

Answer

Cloud Spanner

Answer

Cloud Bigtable

Answer

Cloud SQL

Question 13

An organization requires that all Compute Engine instances in a project must have a specific tag for firewall rule compliance. How can they enforce this?

Accepted Answer

Use a mandatory tag via organization policy. Organization Policies in Google Cloud can enforce constraints that require resources, including Compute Engine instances, to have specific labels or tags. The `compute.requireOsLogin` or custom constraint `compute.requireInstanceTag` can be used to mandate that all instances must have a particular tag, and any instance creation that violates this policy will be denied at the API level, ensuring compliance without relying on user behavior.

Answer

Use IAM roles to restrict instance creation

Answer

Use a startup script to add the tag

Answer

Use Cloud Asset Inventory

Question 14

A company uses Cloud KMS to encrypt sensitive data. They need to ensure that encryption key usage is audited and that keys are rotated automatically every 30 days. Which two actions should they take? (Choose two.)

Accepted Answer

Enable Data Access audit logs for the Cloud KMS API. Enabling Data Access audit logs for the Cloud KMS API captures detailed information about every encryption key usage, including who accessed the key, when, and what operation was performed. This meets the auditing requirement by recording all key usage events in Cloud Audit Logs, which can be reviewed for compliance and security analysis.

Answer

Create a Cloud Trigger to manually rotate the key every month

Answer

Enable Cloud Key Management Service's key usage monitoring

Answer

Use Cloud External Key Manager to rotate keys externally

Question 15

A company wants to enforce that only container images built and signed by their CI/CD pipeline can be deployed in their GKE cluster. Which Google Cloud service should they use?

Accepted Answer

Binary Authorization. Binary Authorization is the Google Cloud service that enforces deploy-time policies on GKE, allowing only container images that meet attestation requirements (e.g., signed by the CI/CD pipeline) to be deployed. It integrates with Container Analysis/Artifact Analysis to verify signatures and attestations before admitting a pod.

Answer

Artifact Analysis

Answer

Cloud Audit Logs

Answer

Cloud Security Command Center