Google PCA Practice Test 40 — 15 Questions

Question 1

A company runs batch processing jobs on a GKE cluster using preemptible node pools. The jobs are fault-tolerant and can be interrupted. However, the cluster is experiencing high costs due to underutilized nodes. The batch jobs run for 2-3 hours each. What is the most cost-effective optimization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create multiple node pools with different machine types and use node auto-provisioning with preemptible nodes and custom machine types.. The most cost-effective because it leverages node auto-provisioning with preemptible nodes and custom machine types, which dynamically creates node pools tailored to the specific resource requirements of each batch job. This eliminates waste from over-provisioned nodes while maintaining fault tolerance for interruptible workloads. Combined with preemptible instances (up to 60-80% cheaper than regular VMs), this approach minimizes cost without sacrificing job completion, as the jobs are already designed to handle interruptions.

Answer

Switch to compute-optimized (C2) machine types for faster job completion.

Answer

Use regional persistent disks for stateful workloads to improve performance.

Answer

Reduce the number of min-nodes in the node pool to zero during idle times and use cluster autoscaler.

Question 2

A company is deploying a web application on Compute Engine. They want to automatically scale the number of instances based on CPU utilization. Which two components are required to set up autoscaling? (Choose two.)

Accepted Answer

Instance template. An instance template is required because it defines the machine configuration (machine type, boot disk image, network tags, etc.) for all VMs created by the autoscaler. Without a template, the managed instance group would have no blueprint to provision new instances when scaling out.

Answer

Cloud Functions

Answer

Cloud Load Balancing

Answer

Cloud Monitoring

Question 3

An organization wants to define an SLO for their API hosted on Cloud Endpoints. Which metric should they use as a Service Level Indicator (SLI) for availability?

Accepted Answer

Ratio of HTTP 200 responses to total requests. For an availability SLO, the SLI must measure the proportion of successful requests. In Cloud Endpoints, availability is defined as the ratio of successful (HTTP 200) responses to total requests, as this directly reflects whether the API is functioning correctly. Option C is correct because it captures the fraction of requests that completed without error, which is the standard definition of availability in service-level monitoring.

Answer

Number of HTTP 5xx errors

Answer

Request latency at the 99th percentile

Answer

CPU utilization of backend instances

Question 4

A company is designing a highly available application on GCE. Which TWO steps should they take to ensure reliability?

Accepted Answer

Use a managed instance group with autohealing.. A managed instance group (MIG) with autohealing automatically replaces unhealthy VM instances based on health check results, ensuring the application remains available even if individual instances fail. This is a core reliability pattern for stateless applications on Compute Engine, as it provides self-healing infrastructure without manual intervention.

Answer

Use a global external HTTP(S) load balancer.

Answer

Use persistent disks without snapshots.

Answer

Deploy instances in a single zone to avoid latency.

Question 5

A company wants to deploy a standard VM image with pre-installed software across multiple projects. Which Google Cloud solution should they use to automate this process?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager (option C) is the correct choice because it allows you to define a declarative template (in YAML, Jinja, or Python) that specifies the VM instance configuration, including the boot disk image with pre-installed software, and then deploy that template consistently across multiple projects. This automates the entire provisioning process, ensuring each VM is identical and reducing manual effort.

Answer

Cloud Build

Answer

Compute Engine

Answer

Cloud Shell

Answer

Artifact Registry

Question 6

You are investigating a Vertex AI Workbench instance (instance-2) that is showing UNHEALTHY status. Based on the exhibit, what is the most likely cause of the issue?

Accepted Answer

The container image gcr.io/my-project/my-image:latest does not exist, or the service account used by the Workbench instance does not have storage.objectViewer access to the container registry.. The UNHEALTHY status in Vertex AI Workbench typically occurs when the instance fails to start its container. Option A is correct because the most likely cause is that the specified container image (gcr.io/my-project/my-image:latest) does not exist in Container Registry, or the service account attached to the instance lacks the storage.objectViewer role on the registry bucket. Without this permission, the instance cannot pull the image, leading to a container creation failure and an UNHEALTHY state. Options B, C, and D are less likely given the focus on the container image in the exhibit.

Answer

The container registry endpoint is blocked by a firewall rule that does not allow egress to gcr.io.

Answer

The instance's underlying Compute Engine resources are exhausted, causing the container creation to timeout.

Answer

The Workbench instance is using an outdated custom image that is not compatible with the latest runtime version.

Question 7

When will the key be automatically rotated?

Accepted Answer

Every 90 days. In Google Cloud, customer-managed encryption keys (CMEK) can be configured for automatic rotation with a default period of 90 days. This is enforced by Cloud Key Management Service (Cloud KMS) to limit the exposure window if a key is compromised.

Answer

Every 180 days

Answer

Only when manually triggered

Answer

Every 30 days

Question 8

A company wants to provision multiple similar environments (dev, test, prod) with consistent networking configurations. Which approach is a best practice for infrastructure as code?

Accepted Answer

Use a single Terraform configuration with workspaces.. Terraform workspaces allow you to manage multiple distinct environments (e.g., dev, test, prod) from a single configuration by maintaining separate state files. This ensures consistent networking configurations across environments while avoiding duplication of code, which is a core best practice for infrastructure as code.

Answer

Use Ansible playbooks to run ad-hoc commands.

Answer

Run separate gcloud commands for each environment.

Answer

Use Cloud Deployment Manager templates with environment-specific parameters.

Question 9

A healthcare organization stores Protected Health Information (PHI) in Cloud SQL. They have implemented encryption at rest using CMEK and enforce TLS for all connections. To meet HIPAA compliance, they need to ensure that PHI cannot be exfiltrated from the Cloud SQL instance even if an application is compromised. The Cloud SQL instance is accessed by Compute Engine instances in the same VPC using private IPs. The security team wants to add an additional layer of defense against data exfiltration. What should they do?

Accepted Answer

Configure VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect.. VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect prevents data exfiltration by creating a security boundary around the Cloud SQL instance. Even if an application is compromised, the service perimeter blocks unauthorized copying or movement of PHI outside the perimeter, and Private Service Connect ensures traffic stays within Google's network without traversing the public internet. This directly addresses the requirement for an additional layer of defense against exfiltration beyond encryption and TLS.

Answer

Deploy Cloud Armor and apply a WAF rule to block suspicious traffic to the Cloud SQL instance.

Answer

Use the Cloud SQL Auth proxy from all applications to enforce IAM-based authentication.

Answer

Enable customer-managed encryption keys (CMEK) on the Cloud SQL instance.

Question 10

Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?

Accepted Answer

Create separate subnets for each application tier.. Creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.

Answer

Disable VPC Flow Logs to reduce cost.

Answer

Use a single subnet for all tiers to simplify IP management.

Answer

Rely on the default priority of firewall rules to ensure proper ordering.

Question 11

A company runs a global e-commerce platform on Google Kubernetes Engine (GKE) with a Cloud SQL for MySQL database. During promotions, traffic spikes cause database connection limits to be exceeded, leading to errors. The application uses the Cloud SQL Auth Proxy. What is the MOST scalable and cost-effective solution?

Accepted Answer

Use a connection pooler such as ProxySQL deployed in the GKE cluster. Connection pooling (e.g., using PgBouncer for PostgreSQL, but for MySQL, similar poolers like ProxySQL or built-in connection pooling) allows the application to reuse connections and handle many concurrent requests without hitting database connection limits. Increasing the database tier or proxy instances adds cost and may not address the underlying issue of connection churn.

Answer

Configure the Cloud SQL Auth Proxy to use private IP and increase pool size

Answer

Upgrade the Cloud SQL instance to a higher tier with more connections

Answer

Increase the number of Cloud SQL Auth Proxy replicas

Question 12

You have a Cloud Deploy delivery pipeline with an approval gate. You want to automatically roll back a release if the rollout fails during the deploy step. How should you configure the pipeline?

Accepted Answer

Set an automatic rollback policy in the delivery pipeline definition. Cloud Deploy does have a built-in automatic rollback feature via the `rollback_policy` in the delivery pipeline definition. Setting this policy automatically rolls back a release if the rollout fails during the deploy step. Option B describes a custom solution that is unnecessary because the native policy exists. Option C is incorrect because approval gates are for manual approval and cannot automatically trigger a rollback. Option D is incorrect because no such global flag exists. Therefore, option A is correct.

Answer

Use a Cloud Build post-deploy hook to check the rollout status and roll back if needed

Answer

Configure the approval gate to reject the deployment if it fails

Answer

Enable the 'rollback on failure' flag in the pipeline

Question 13

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to optimize costs without sacrificing availability. They have varying traffic patterns. Which strategy should they recommend?

Accepted Answer

Use node auto-provisioning with preemptible nodes.. Node auto-provisioning with preemptible nodes allows the cluster to automatically scale and use low-cost, short-lived instances for fault-tolerant workloads. Preemptible nodes are up to 60-91% cheaper than regular instances, and node auto-provisioning ensures that only the required node types are created, optimizing cost without sacrificing availability for stateless microservices that can handle interruptions.

Answer

Use committed use discounts with a 3-year term on all nodes.

Answer

Use GKE Autopilot with a single node pool.

Answer

Use a regional cluster with node pools of different machine types.

Question 14

A startup wants to deploy a containerized web application that scales automatically to zero when not in use, and only pays for resources consumed during request processing. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it is a fully managed serverless platform that automatically scales your containerized application to zero when there are no incoming requests, and you only pay for the resources (vCPU, memory, and networking) consumed during request processing. This aligns perfectly with the requirement for a containerized web app that scales to zero and uses a pay-per-use model.

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Standard

Answer

Compute Engine with preemptible VMs

Question 15

A media company stores video files in Cloud Storage for streaming. Infrequently accessed videos older than 90 days are currently in Standard storage. To reduce costs, they want to automatically move these files to a lower-cost storage class and delete them after 3 years. Which configuration should they use?

Accepted Answer

Use a lifecycle rule with condition 'age > 90 days' to set storage class to Nearline, and another rule with 'age > 1095 days' to delete.. Cloud Storage lifecycle policies can automatically transition objects between storage classes or delete them based on age. Setting conditions for transition to Nearline (or Coldline/Archive) after 90 days and deletion after 1095 days (3 years) is the correct approach.

Answer

Configure a Pub/Sub notification on object changes and process via Dataflow.

Answer

Use gsutil rewrite command with -s option manually for each file.

Answer

Create a Cloud Function that moves objects monthly using a cron job.