Google PCA Practice Test 39 — 15 Questions

Question 1

A multinational corporation must comply with GDPR and requires that all customer data stored in BigQuery be encrypted using customer-managed encryption keys (CMEK) and that the keys are stored in a specific region. Which combination of steps should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud KMS key ring and crypto key in the desired region, then associate the BigQuery dataset with the CMEK key using DDL. It directly fulfills the requirement: creating a Cloud KMS key ring and crypto key in the desired region, then associating the BigQuery dataset with that CMEK key using DDL (e.g., `ALTER SCHEMA mydataset SET OPTIONS(kms_key_name='...')`). This ensures that all data at rest in BigQuery is encrypted with a customer-managed key stored in a specific regional location, as mandated by GDPR for data residency and control.

Answer

Enable default encryption at rest in BigQuery and use Organization Policies to restrict key location

Answer

Create a Cloud HSM key, then use Cloud DLP to automatically encrypt the data before loading into BigQuery

Answer

Use Cloud External Key Manager (EKM) to integrate with an on-premises key management system

Question 2

An organization has a security policy that prohibits the use of external IP addresses on Compute Engine instances to reduce attack surface. They want to enforce this policy across all new and existing projects. Which approach should they use?

Accepted Answer

Use Organization Policy with constraint compute.vmExternalIpAccess. The Organization Policy constraint `compute.vmExternalIpAccess` is the correct approach because it allows you to set a policy at the organization, folder, or project level that denies the assignment of external IP addresses to Compute Engine instances. This policy is enforced at resource creation time and applies to all new and existing VM instances, ensuring compliance with the security policy across the entire resource hierarchy. It directly prevents the use of external IPs, reducing the attack surface without requiring per-project or per-instance configuration.

Answer

Use IAM conditions to prevent creation of instances with external IPs

Answer

Use Cloud Security Command Center to detect and alert on external IPs

Answer

Use VPC Firewall rules to block traffic to external IPs

Question 3

An e-commerce platform uses Cloud SQL for PostgreSQL to serve product catalog data. As traffic grows, the database experiences high connection overhead and latency spikes. The team wants to reduce connection overhead and improve performance without changing application code. Which solution should they implement?

Accepted Answer

Use Memorystore (Redis) to cache database queries.. Memorystore (Redis) caches database query results, reducing the number of queries hitting Cloud SQL. This lowers connection overhead because fewer connections are opened, and improves latency by serving repeated queries from an in-memory cache. No application code changes are needed if the caching layer is deployed as an intermediary. Option C is incorrect because Cloud SQL Auth Proxy only provides secure connectivity and does not perform connection pooling; a dedicated pooler like PgBouncer would be required.

Answer

Migrate to Cloud Spanner for better scalability.

Answer

Use Cloud SQL Auth Proxy with connection pooling enabled.

Answer

Increase the maximum connections setting in Cloud SQL to handle more concurrent connections.

Question 4

A company is migrating its on-premises application to Google Cloud. The application requires low-latency access to a shared filesystem that can be mounted by multiple Compute Engine instances across different zones. Which storage solution should they use?

Accepted Answer

Provision a Filestore instance and mount it on the instances.. Filestore provides a fully managed, NFS-based shared filesystem that can be mounted by multiple Compute Engine instances across different zones with low-latency access. It supports the required multi-writer, multi-mount scenario natively, making it the ideal choice for shared storage in a zonal-distributed architecture.

Answer

Create a Persistent Disk and attach it to all instances.

Answer

Attach Local SSD to each instance and replicate data between them.

Answer

Use Cloud Storage FUSE to mount a bucket on each instance.

Question 5

Which THREE steps can reduce processing costs in a Dataflow streaming pipeline? (Choose three.)

Accepted Answer

Use side inputs instead of a cross join.. Side inputs allow you to broadcast a static or slowly-changing dataset to all workers, avoiding the expensive shuffle and per-element processing required by a cross join. In Dataflow, cross joins in streaming mode require stateful processing and can lead to high data amplification, whereas side inputs are distributed efficiently via the streaming engine. This reduces both CPU and memory costs by eliminating redundant data movement.

Answer

Use a custom runner.

Answer

Increase the number of workers.

Question 6

A cloud architect is implementing a CI/CD pipeline for a microservices-based application on Google Kubernetes Engine (GKE). The team needs to deploy new versions of the services with zero downtime and the ability to quickly roll back if issues are detected. Which two strategies should the architect consider? (Choose two.)

Accepted Answer

Blue/green deployment. Blue/green deployment (C) and canary deployment (D) are two strategies that provide zero downtime and quick rollback. Blue/green deploys new version to a separate environment and switches traffic; canary gradually shifts traffic and allows easy rollback. Rolling update (B) also provides zero downtime but rollback requires a new update, not immediate. Shadow deployment (A) mirrors traffic for analysis but doesn't serve users. A/B testing (E) is a method for comparing features but not a deployment strategy.

Answer

Shadow deployment

Answer

Rolling update

Answer

A/B testing deployment

Question 7

A company runs a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage and low-latency access across multiple zones. The application needs to perform well even during zonal failures. Which storage solution should they use?

Accepted Answer

Regional persistent disk. Regional persistent disks (RPDs) synchronously replicate data across two zones in the same region, providing both the persistent storage and low-latency access required by the stateful application. This ensures that if one zone fails, the disk can be attached to a pod in the surviving zone without data loss or significant performance degradation, meeting the high-availability and multi-zone access requirements.

Answer

Zonal persistent disk with snapshots to another zone

Answer

Local SSDs attached to nodes

Answer

Cloud Filestore

Question 8

An organization runs a stateful application on GKE that must not lose data during cluster upgrades or node repairs. The application uses persistent volumes with ReadWriteOnce access mode. The team wants to ensure pods are not evicted simultaneously. Which Kubernetes resource should they configure?

Accepted Answer

PodDisruptionBudget. PodDisruptionBudget (PDB) specifies the minimum number of available pods that must remain up during voluntary disruptions, such as node upgrades.

Answer

ClusterAutoscaler

Answer

HorizontalPodAutoscaler

Answer

VerticalPodAutoscaler

Question 9

A company runs a batch processing workload on Compute Engine. They need to minimize cost and ensure jobs complete within a 24-hour window. Which THREE strategies should they implement? (Choose 3.)

Accepted Answer

Use preemptible VMs for fault-tolerant jobs.. Preemptible VMs are significantly cheaper than standard VMs and are ideal for batch processing workloads that are fault-tolerant. Since the job can handle interruptions and be restarted, using preemptible VMs directly reduces cost while still completing within the 24-hour window if the job is designed to checkpoint progress.

Answer

Use sole-tenant nodes for resource isolation.

Answer

Configure instance reservations for guaranteed capacity.

Question 10

A company runs a containerized application on Cloud Run. Which TWO actions will most improve the reliability of the service?

Accepted Answer

Deploy the service in multiple regions. Deploying the service in multiple regions (Option C) improves reliability by distributing traffic across geographically separate Cloud Run instances, so if one region fails, traffic can be routed to healthy regions via a global load balancer. Setting min instances to at least 1 (Option D) prevents cold starts and ensures that at least one container instance is always running, reducing latency spikes and avoiding request failures during scale-from-zero events.

Answer

Enable CPU always allocated

Answer

Disable concurrency

Answer

Use Cloud CDN

Question 11

A company needs to store secrets such as API keys and database passwords securely and access them from Compute Engine instances. Which service provides secret storage with built-in IAM integration and automatic rotation?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing secrets with IAM and versioning. It also supports rotation via Cloud Functions or Pub/Sub.

Answer

Cloud HSM

Answer

Cloud Storage

Answer

Cloud KMS

Question 12

Drag and drop the steps to configure a Cloud Load Balancer with a backend service consisting of Compute Engine instances into the correct order.

Accepted Answer

First, create a health check. Then, create an instance group. Next, create a backend service that uses the health check and add the instance group as a backend. After that, create a URL map to route requests to the backend service. Then, create a target HTTP(S) proxy using the URL map. Finally, create a forwarding rule to assign an IP address and port to the proxy.. Health checks ensure traffic only goes to healthy instances; URL map defines routing; forwarding rule exposes the IP.

Answer

First, create a URL map. Then, create a target proxy. Next, create a forwarding rule. After that, create a health check. Then, create an instance group. Finally, create a backend service (with health check) and add the instance group.

Answer

First, create an instance group. Then, create a backend service (without a health check). Next, create a URL map. Then, create a target proxy. After that, create a forwarding rule. Finally, create a health check (too late to attach to the backend service).

Answer

First, create a forwarding rule. Then, create a target proxy. Next, create a URL map. After that, create a backend service. Then, create an instance group. Finally, create a health check.

Question 13

A company has Compute Engine instances that need to access the internet for updates but should not be reachable from the internet. They also need to access Google APIs and services like Cloud Storage. Which configuration meets these requirements?

Accepted Answer

Use Cloud NAT for outbound internet and enable Private Google Access on the subnet.. Cloud NAT provides outbound internet connectivity for instances without external IPs, while Private Google Access allows those same instances to reach Google APIs and services (like Cloud Storage) using internal IPs via the subnet's default route. This combination ensures instances can initiate outbound connections to the internet and Google services but remain unreachable from the internet, meeting both security and functional requirements.

Answer

Assign external IPs to all instances and configure firewall rules to block inbound traffic.

Answer

Configure a VPN tunnel to an on-premises proxy server for internet access.

Answer

Use Cloud NAT for outbound internet and use external IPs for Google API access.

Question 14

Your company runs a critical application on Google Kubernetes Engine (GKE) with 5 nodes. The application experiences intermittent high latency every Friday afternoon. The team has ruled out infrastructure issues and suspects the application logic. You need to instrument the application to identify the root cause. Which approach should you take?

Accepted Answer

Use Cloud Monitoring to create custom metrics for application performance and investigate recent code changes.. The team has already ruled out infrastructure issues and suspects application logic. Creating custom metrics in Cloud Monitoring allows you to instrument the application with key performance indicators (e.g., request latency, error rates) and correlate them with recent code changes to pinpoint the root cause of intermittent high latency. This approach directly addresses the need to monitor application-level behavior rather than infrastructure metrics.

Answer

Increase the number of nodes in the GKE cluster to handle the load.

Answer

Enable Cloud Logging and analyze logs for error messages during the latency periods.

Answer

Configure GKE usage metering to track resource consumption by namespace.

Question 15

Your company runs a critical application on Compute Engine instances in a managed instance group across three zones. The application writes logs to local disk. You are asked to improve the reliability of log retention and ensure logs are available in case of instance failure. You have already configured a health check that automatically recreates instances. However, after a recent zonal outage, logs from the affected instances were lost. You need to implement a solution that preserves logs even when instances are terminated. What should you do?

Accepted Answer

Install the Cloud Logging agent on each instance and configure it to stream application logs to Cloud Logging.. The Cloud Logging agent streams logs directly to Cloud Logging (now part of Google Cloud's operations suite), which stores logs independently of the Compute Engine instances. This ensures logs are preserved even if instances are terminated due to a zonal outage or health check recreation, as logs are sent to a centralized, durable logging service rather than being stored on local disk.

Answer

Increase the size of the local SSD to accommodate more logs and set a longer retention period.

Answer

Configure each instance to write logs to a persistent disk that is retained after instance deletion.

Answer

Mount a Cloud Storage bucket using gcsfuse on each instance and write logs directly to the bucket.