Google PCA Practice Test 38 — 15 Questions

Question 1

A company is moving a legacy application to Compute Engine. The application has inconsistent resource usage and the team wants to optimise costs without performance degradation. They are evaluating committed use discounts (CUDs) and other discount types. Which THREE statements are correct about CUDs? (Choose 3)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Spend-based CUDs are applied automatically to all eligible projects in the billing account. Option B is correct because spend-based (flexible) committed use discounts are automatically applied across all eligible projects within the billing account, requiring no per-project management. Option D is correct because CUDs fundamentally exchange a 1-year or 3-year commitment to a minimum spend or resource usage for a discounted rate on Compute Engine resources. Option E is correct because resource-based CUDs are scoped to a specific machine family/series and region, so the commitment only discounts matching vCPUs and memory in that region. Option A is wrong because CUDs have no 10-instance minimum; commitments are made in terms of spend or resource quantities. Option C is wrong because CUDs can be combined with sustained use discounts, with SUDs applying to usage not already covered by the CUD.

Answer

CUDs require a minimum of 10 instances to qualify

Answer

CUDs cannot be combined with sustained use discounts

Question 2

A company wants to implement a zero-trust access model for internal web applications running on Compute Engine. They need to authenticate users using corporate credentials and enforce context-aware access based on device posture and IP address. Which TWO services should they use?

Accepted Answer

Cloud Identity. Cloud Identity (C) is correct because it provides the identity provider and user/group management that lets the company authenticate users with their corporate credentials, which is the foundation of a zero-trust identity model. Identity-Aware Proxy (IAP) (E) is correct because it enforces context-aware access to internal web applications on Compute Engine, evaluating user identity plus device posture and IP address before granting access, exactly matching the scenario's requirements. VPC Service Controls (A) is not correct here because it protects Google Cloud APIs and services at the perimeter level rather than authenticating users to internal web apps. Cloud VPN (B) only provides encrypted network connectivity and does not perform user authentication or context-aware access control. Cloud Armor (D) is a WAF/DDoS protection service that filters traffic at the edge but does not authenticate users or enforce device-posture-based access.

Answer

VPC Service Controls

Answer

Cloud VPN

Answer

Cloud Armor

Question 3

A startup is developing a real-time analytics dashboard that ingests data from IoT devices. The data volume is unpredictable but can spike to millions of events per second. The dashboard must display near real-time aggregations with sub-second latency. Which Google Cloud architecture should the architect recommend?

Accepted Answer

Ingest via Cloud Pub/Sub, process with Cloud Dataflow, store in Cloud Bigtable, and query from the dashboard.. Cloud Pub/Sub provides scalable, asynchronous ingestion for unpredictable IoT data spikes, Cloud Dataflow enables stream processing for near real-time aggregations with sub-second latency, and Cloud Bigtable offers low-latency, high-throughput storage ideal for serving aggregated results directly to a dashboard. This combination meets the requirements of unpredictable volume, real-time processing, and low-latency queries.

Answer

Ingest via Cloud IoT Core directly to Cloud Bigtable, then query with BigQuery.

Answer

Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in Cloud Storage, and query with BigQuery.

Answer

Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use Cloud SQL for aggregations.

Question 4

A company is using Cloud SQL for PostgreSQL and needs to run a one-time heavy analytical query that takes over 30 minutes and uses 100% CPU. The production database is serving user traffic with high QPS. What should the company do to run the query without impacting production?

Accepted Answer

Create a read replica of the production instance and run the query on the replica.. A read replica in Cloud SQL for PostgreSQL is a separate instance that asynchronously replicates data from the primary. Running the heavy analytical query on the replica offloads the CPU-intensive workload from the production primary, ensuring user-facing traffic with high QPS is not impacted. The replica can handle read-only queries without affecting the primary's performance or availability.

Answer

Run the query directly on the primary instance during low traffic hours.

Answer

Use Cloud SQL's pgBouncer to pool connections and queue the query.

Answer

Create a clone of the production instance and run the query on the clone.

Question 5

Your organization wants to use Cloud SQL for a MySQL database with automatic failover in the event of a zone outage. Which configuration should you choose?

Accepted Answer

Create a regional Cloud SQL instance (high availability) with a primary and standby zone. A regional Cloud SQL instance (high availability) provisions a primary and a standby instance in two zones within the same region, with automatic failover to the standby if the primary zone fails. This is the native Cloud SQL HA configuration for zone-outage resilience. Cross-region read replicas and external replication are for read scaling or DR, not automatic same-region failover.

Answer

Set up Cloud SQL with external replication to a VM in another zone

Answer

Create a Cloud SQL instance with a cross-region read replica

Answer

Create a single-zone Cloud SQL instance with automatic backups enabled

Question 6

A startup wants to grant a new employee read-only access to view all Compute Engine instances in a project. What is the minimum IAM role they should assign?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list and view instances, without allowing modifications. This is the minimum IAM role that satisfies the requirement for read-only access to all Compute Engine instances in a project, as it provides the necessary permissions (e.g., compute.instances.list, compute.instances.get) without granting broader project-level or write permissions.

Answer

roles/owner

Answer

roles/iam.securityReviewer

Answer

roles/compute.admin

Question 7

A company wants to enforce that all secrets used by applications running on Compute Engine are rotated automatically every 30 days. Which GCP service should they use to store and manage these secrets?

Accepted Answer

Secret Manager. Google Cloud Secret Manager is purpose-built for storing, versioning, and rotating secrets such as API keys, passwords, and certificates. It supports automatic rotation via Pub/Sub notifications and Cloud Functions/Cloud Run, and it integrates natively with Compute Engine workloads through IAM and the Secret Manager API. Cloud KMS, by contrast, manages encryption keys, not application secrets.

Answer

Cloud Key Management Service with CMEK

Answer

Environment variables

Answer

Cloud KMS

Question 8

A company uses Cloud Storage for analytics data with lifecycle policies to move objects from Standard to Coldline after 30 days and delete after 365 days. They notice that objects are being deleted after 30 days instead of 365. What is the most likely cause?

Accepted Answer

The lifecycle rule is set to delete objects after 30 days instead of transitioning to Coldline.. Lifecycle rules apply in order; if a rule is set to delete after 30 days, it will delete regardless of earlier transitions. The most likely issue is that the rules are configured incorrectly: there may be a delete rule with age 30 days overriding the transition rule. The correct order should be: transition to Coldline at 30 days, then delete at 365 days.

Answer

An IAM policy is inadvertently allowing users to delete objects.

Answer

The Coldline storage class has a minimum storage duration of 30 days, causing immediate deletion.

Answer

The bucket is using a uniform bucket-level access policy.

Question 9

A company has a multi-region deployment of App Engine and wants to optimize request routing for latency and cost. Which GCP service should they use?

Accepted Answer

Cloud Load Balancing with global anycast.. Cloud Load Balancing with global anycast uses Google's global network and anycast IP addresses to route user traffic to the nearest healthy backend, minimizing latency. It also supports premium tier routing for lower latency and standard tier for lower cost, directly addressing the optimization goals for a multi-region App Engine deployment.

Answer

Cloud Endpoints.

Answer

Cloud DNS with latency-based routing.

Answer

Cloud Traffic Director.

Question 10

A data engineering team wants to ingest streaming data from Pub/Sub, transform it using Apache Beam, and load it into BigQuery for real-time analytics. They need a fully managed solution that handles autoscaling and does not require managing servers. Which TWO Google Cloud services should they use?

Accepted Answer

Cloud Dataflow. Option B, Cloud Dataflow, is correct because it is Google Cloud's fully managed, serverless runner for Apache Beam pipelines, automatically handling autoscaling of worker instances and eliminating server management for the transform-and-load stage into BigQuery. Option E, Cloud Pub/Sub, is correct because it is the fully managed, serverless messaging service used to ingest the streaming data that Dataflow then reads and processes. Together, Pub/Sub provides the ingestion layer and Dataflow provides the managed Beam processing that writes results to BigQuery for real-time analytics. Option A, Cloud Dataproc, is not appropriate because it is a managed Spark/Hadoop cluster service that still requires cluster provisioning and management rather than being serverless. Option C, Cloud Dataprep, is a data-wrangling UI for preparing data, not a streaming Beam execution engine. Option D, Cloud Composer, is a managed Apache Airflow workflow orchestrator for scheduling batch pipelines, not a streaming data processing service.

Answer

Cloud Dataproc

Answer

Cloud Dataprep

Answer

Cloud Composer

Question 11

A team is migrating a monolithic application to microservices on GKE. They want to gradually shift users to the new microservices version while keeping the old monolithic version running. They need to route a small percentage of users based on a cookie. Which traffic management approach should they use?

Accepted Answer

Use Istio VirtualService with match rules based on cookie and weighted destinations. Istio traffic management allows fine-grained routing based on HTTP headers, cookies, or other attributes. It supports traffic splitting and canary deployments with precise percentage control.

Answer

Use Kubernetes Services with multiple Deployments and manual scaling

Answer

Configure an HTTP(S) load balancer with URL maps and backend services

Answer

Deploy two separate GKE clusters and use DNS-based traffic splitting

Question 12

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Accepted Answer

Grant the service account roles/storage.objectViewer on the bucket and remove all other bindings.. The principle of least privilege dictates that the service account should be granted only the minimal permissions required to read objects, which is roles/storage.objectViewer. By removing all other bindings, the bucket becomes accessible exclusively to that service account, ensuring that no other identities (users, groups, or other service accounts) can read the sensitive data. This approach directly enforces the requirement using IAM roles on the bucket resource.

Answer

Grant the service account roles/iam.serviceAccountUser on the bucket.

Answer

Use a signed URL to allow access for the service account.

Answer

Grant the service account roles/storage.admin on the bucket.

Question 13

A company is deploying a web application on Compute Engine behind a global HTTP(S) load balancer. They want to restrict access to only traffic from specific IP ranges. Which load balancer feature should they use?

Accepted Answer

Cloud Armor security policies.. Cloud Armor security policies are the correct choice because they allow you to define IP-based allow/deny rules at the edge of Google's network, directly integrated with the global HTTP(S) load balancer. This provides granular access control based on source IP ranges before traffic reaches your backend instances, which is exactly what the requirement specifies.

Answer

VPC firewall rules.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud CDN.

Question 14

Which Google Cloud service allows organizations to define perimeters that protect resources and data from exfiltration to other VPCs or networks?

Accepted Answer

VPC Service Controls. VPC Service Controls lets organizations define service perimeters that restrict access to Google Cloud services and prevent data exfiltration across project, VPC, or network boundaries. It enforces context-aware access at the API level, blocking operations that would move data outside the perimeter even if IAM would otherwise allow them. This is exactly the 'protect resources and data from exfiltration to other VPCs or networks' requirement.

Answer

Private Service Connect

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Armor

Question 15

An engineer wants to migrate an on-premises MySQL database (5.6) to Cloud SQL for MySQL with minimal downtime. Which service should they use?

Accepted Answer

Database Migration Service. Database Migration Service (DMS) is purpose-built for migrating relational databases like MySQL 5.6 to Cloud SQL with minimal downtime. It performs an initial full load followed by continuous change data capture (CDC) replication from the source, allowing cutover with seconds of downtime. DMS natively supports MySQL, PostgreSQL, and SQL Server sources into Cloud SQL and AlloyDB.

Answer

Migrate for Compute Engine (formerly Velostrata)

Answer

Storage Transfer Service

Answer

BigQuery Data Transfer Service