Google PCA Practice Test 38 — 15 Questions

Question 1

You manage a batch data processing workload on Compute Engine that runs daily on a single VM. The VM uses a standard persistent disk (pd-standard) for input data and output results. Recently, the VM crashed due to a hardware failure, and the job failed. You need to implement a solution that automatically recovers from VM failures with minimal data loss. The job is idempotent and can restart from the beginning if necessary. Which solution should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a managed instance group (MIG) with an instance template that includes a startup script to run the job, and enable autohealing. A managed instance group (MIG) with autohealing automatically recreates a VM instance when it fails, and the startup script ensures the idempotent job reruns from the beginning on the new VM. This minimizes data loss by using the same persistent disk (or a fresh one) and leverages Compute Engine's health check mechanism to detect failure and trigger recovery without manual intervention.

Answer

Take a snapshot of the persistent disk every hour and create a new VM from the latest snapshot on failure

Answer

Use Cloud Scheduler to restart the VM every hour until the job completes

Answer

Add a startup script to the existing VM to rerun the job on boot, and enable automatic restart

Question 2

A company has a VPC Service Perimeter that protects a project containing BigQuery datasets. They want to allow an external customer's BigQuery job to query data across the perimeter boundary using a private connection. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter that allows access from the external customer's VPC network.. To allow access from outside the perimeter, you can use VPC Service Controls with ingress rules. Additionally, the external customer must use a private connection, such as Cloud VPN or Dedicated Interconnect, to access the perimeter. The ingress rule specifies the source and resources.

Answer

Remove the project from the service perimeter temporarily.

Answer

Use Access Transparency to log cross-perimeter access.

Answer

Grant the external customer's service account the BigQuery User role.

Question 3

A company uses Cloud SQL for MySQL and wants to achieve a Recovery Time Objective (RTO) of less than 5 minutes and a Recovery Point Objective (RPO) of less than 1 minute for a regional disaster. Which configuration should they use?

Accepted Answer

Use Cloud Spanner with multi-region configuration. Cloud Spanner with a multi-region configuration is the only option that can meet an RTO of less than 5 minutes and an RPO of less than 1 minute for a regional disaster. Cloud Spanner provides synchronous replication across multiple regions, ensuring that data is consistent with no data loss (RPO near zero) and automatic failover within seconds, achieving the required RTO. Cloud SQL, even with cross-region replicas or high availability, relies on asynchronous replication (for cross-region) or semi-synchronous replication (for regional HA), which cannot guarantee sub-minute RPO or sub-5-minute RTO during a full regional outage.

Answer

Use Cloud SQL with point-in-time recovery and automated backups

Answer

Use Cloud SQL with cross-region replica and failover

Answer

Enable high availability (regional) with a standby zone

Question 4

A company uses Cloud Storage to store sensitive customer data. They must ensure that data at rest is encrypted with a customer-managed key that is automatically rotated every 90 days. Which Cloud Storage configuration should they use?

Accepted Answer

Enable default encryption with a customer-managed key (CMEK) from Cloud KMS with automatic rotation set to 90 days. Cloud Storage supports CMEK (Customer-Managed Encryption Keys) via Cloud KMS. By using a Cloud KMS key with automatic rotation period of 90 days, objects written to the bucket are encrypted with that key. The bucket's default encryption is set to that key. Customer-supplied encryption keys (CSEK) require manual key management and no automatic rotation. SSE with Google-managed keys does not meet the customer-managed requirement. Using a Cloud HSM key also supports CMEK but for automatic rotation, KMS key rotation is sufficient.

Answer

Use customer-supplied encryption keys (CSEK) and rotate them manually

Answer

Use Cloud HSM to create a key and set the bucket to use that key without rotation policy

Answer

Use Google-managed encryption keys (SSE-GM)

Question 5

A company runs a batch processing job every night that takes 4 hours on a single n2-standard-8 VM. They are willing to accept up to 2 minutes of additional completion time in exchange for significant cost savings. The job is fault-tolerant and can be restarted if interrupted. Which compute option should they use?

Accepted Answer

Use a spot VM (preemptible) with a custom machine type n2-standard-8. Preemptible VMs offer up to 80% discount but can be terminated at any time. Since the job is fault-tolerant and can handle interruptions, this is the best cost-saving option with minimal impact on completion time.

Answer

Reserve an n2-standard-8 with a 1-year committed use discount

Answer

Deploy on Cloud Run with 8 vCPUs

Answer

Use a sole-tenant node with the n2-standard-8 machine type

Question 6

A security team wants to audit all IAM role assignments in an organization. They need a historical record of changes. Which tool should they use?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify IAM policies, including role assignments. These logs are immutable and retained for the default retention period (400 days for Admin Activity logs), providing a historical record of changes. Cloud Asset Inventory (A) shows the current state but not historical changes, Access Transparency (B) logs Google staff access to your data, and Security Command Center (D) provides security findings and posture, not a change history.

Answer

Cloud Asset Inventory

Answer

Access Transparency

Answer

Security Command Center

Question 7

A company needs to store archival data that is accessed less than once a year and must be retained for 10 years for compliance. The data retrieval time is not critical. Which Cloud Storage class is MOST cost-effective?

Accepted Answer

Archive storage class. Archive storage is the cheapest class for long-term archival data accessed less than once a year. Coldline is for 90-day access, Nearline for 30-day, and Standard for frequent access. Archive has the lowest storage cost but higher retrieval costs and minimum storage duration of 365 days.

Answer

Coldline storage class

Answer

Standard storage class

Answer

Nearline storage class

Question 8

A financial services company runs a critical PostgreSQL database on Cloud SQL. They need to ensure automatic failover to a replica in another zone within the same region with minimal data loss. What configuration should they choose?

Accepted Answer

Configure a Cloud SQL HA instance with a failover replica in a different zone. Cloud SQL for PostgreSQL offers a High Availability (HA) configuration that provisions a standby instance in a different zone within the same region. Automatic failover is provided with synchronous replication to minimize data loss.

Answer

Use Database Migration Service to replicate to a second Cloud SQL instance

Answer

Enable point-in-time recovery (PITR) and increase backup retention

Answer

Create a cross-region read replica and manually promote it on failure

Question 9

Your company uses Cloud Storage to store critical documents. You need to prevent accidental deletion or modification of objects for a retention period of 5 years. Which TWO features should you use?

Accepted Answer

Object versioning. Object versioning preserves previous versions of objects, allowing recovery from accidental deletion or overwrite. Retention policies (bucket-level) enforce a minimum retention period for all objects. Bucket Lock makes the retention policy immutable. Object holds are per-object and can be removed. Lifecycle policies manage object transitions/deletion, not retention enforcement.

Answer

Object hold

Answer

Requester pays

Answer

Lifecycle rule to delete objects older than 5 years

Question 10

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Answer

Cloud Spanner

Answer

BigQuery

Answer

Firestore

Question 11

A company has a Cloud SQL for MySQL instance with automated backups enabled. They need to recover the database to a specific point in time within the last hour. Which feature should they use?

Accepted Answer

Point-in-time recovery (PITR). Point-in-time recovery (PITR) restores a Cloud SQL instance to a specific time, using binary logs. Automated backups alone restore to the backup time, not arbitrary points. Failover replica is for high availability. Import is for loading data from a file.

Answer

Failover replica

Answer

Automated backup restore

Answer

Import using the mysqldump file

Question 12

Refer to the exhibit. A user alice@example.com is unable to list objects in bucket 'bucket-b'. What is the most likely reason?

Accepted Answer

The condition restricts access only to bucket-a.. The IAM policy condition explicitly restricts access to resources with a name matching 'bucket-a'. Since the user is trying to list objects in 'bucket-b', the condition evaluates to false, and the IAM policy does not grant the required permissions. Without a matching condition, the effective permission set is empty, causing the list operation to fail.

Answer

The IAM policy is missing the roles/storage.objectAdmin role.

Answer

The condition expression is invalid.

Answer

The user needs the roles/storage.legacyBucketReader role.

Question 13

A company running a globally distributed application uses Firestore in Native mode. They need strong consistency for reads and writes across multiple regions. Which deployment strategy should they use?

Accepted Answer

Use Cloud Spanner. Firestore supports multi-region replication but only provides eventual consistency across regions. Cloud Spanner offers strong consistency globally. Firestore in Datastore mode also offers eventual consistency. Therefore, for strong consistency across regions, Cloud Spanner is required.

Answer

Use Bigtable with replication

Answer

Use Firestore in Datastore mode

Answer

Use Firestore in multi-region (nam5 or eur3)

Question 14

An organization's security policy requires that all Compute Engine VMs have Shielded VM features enabled. How can this be enforced at the organization level?

Accepted Answer

Create an Organization Policy with the constraint compute.requireShieldedVm.. The Organization Policy constraint `compute.requireShieldedVm` is a Google Cloud-native mechanism that enforces Shielded VM features at the organization, folder, or project level. When this constraint is applied, any Compute Engine VM creation request that does not include Shielded VM settings (such as Secure Boot, vTPM, and Integrity Monitoring) is denied by the Organization Policy service, ensuring compliance without relying on user behavior or manual review.

Answer

Enable Cloud Audit Logs and review VM creations.

Answer

Use VPC Service Controls to restrict VM creation.

Answer

Assign a custom IAM role that only allows creation of Shielded VMs.

Answer

Use Deployment Manager templates that include Shielded VM.

Question 15

An organization needs to connect an on-premises data center to Google Cloud using Dedicated Interconnect with a 10 Gbps link. They require high availability and want to achieve 99.99% SLA. What is the minimum number of VLAN attachments and Interconnect connections needed?

Accepted Answer

Two Interconnect connections, each with one VLAN attachment.. To achieve 99.99% SLA with Dedicated Interconnect, you need two separate Interconnect connections (for physical diversity) and each connection must have at least one VLAN attachment. The SLA requires redundant paths; a single Interconnect connection, even with multiple VLAN attachments, does not provide physical diversity and thus cannot meet the 99.99% uptime target.

Answer

One Interconnect connection with two VLAN attachments.

Answer

Four Interconnect connections with one VLAN attachment each.

Answer

Two Interconnect connections, each with two VLAN attachments.