Google PCA Practice Test 40 — 15 Questions

Question 1

A company wants to run a legacy application on Google Cloud that requires a specific operating system version and kernel tuning. The application is not containerised and cannot be easily modified. Which compute service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compute Engine. Compute Engine provides full control over the virtual machine, including the OS and kernel parameters, making it ideal for legacy applications that require custom configurations.

Answer

Cloud Run

Answer

App Engine Flexible Environment

Answer

Google Kubernetes Engine (GKE)

Question 2

A company uses preemptible VMs for batch processing. They notice that during peak hours, many instances are terminated before finishing their tasks. The operations team observes the output shown in the exhibit. Which action would best improve job completion rates without significantly increasing costs?

Accepted Answer

Use instance groups with a mix of preemptible and regular VMs. Using a mixed instance group with both preemptible and regular VMs allows the batch processing job to continue on regular VMs when preemptible VMs are terminated during peak hours. This balances cost and reliability: preemptible VMs handle most of the workload at low cost, while regular VMs act as a fallback to ensure job completion without the full expense of switching entirely to regular VMs.

Answer

Increase the number of instances to compensate for terminations

Answer

Use sole-tenant nodes for these instances

Answer

Use committed use discounts for 1 year

Answer

Switch to regular VMs for critical jobs

Question 3

A company wants to restrict data exfiltration from its Google Cloud projects by preventing resources from copying data to external IP addresses. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls is the correct choice because it creates a security perimeter around Google Cloud resources, such as BigQuery or Cloud Storage, and prevents data exfiltration by blocking access from outside the perimeter or to external IP addresses. It enforces context-aware access policies that can deny egress traffic to non-permitted destinations, directly addressing the requirement to restrict copying data to external IPs.

Answer

HTTPS Load Balancer

Answer

Cloud Armor

Answer

Cloud NAT

Question 4

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single on-premises server and uses a local MySQL database. The company wants to minimize changes to the application code while improving scalability and reliability. Which migration strategy should the architect recommend?

Accepted Answer

Rehost the application on Compute Engine and use Cloud SQL for MySQL as the database.. Rehosting (lift-and-shift) the monolithic application to Compute Engine with Cloud SQL for MySQL minimizes code changes while improving scalability and reliability. Cloud SQL provides managed MySQL with automated backups, replication, and failover, addressing the need for reliability without requiring application refactoring.

Answer

Refactor the application into microservices and deploy on Google Kubernetes Engine.

Answer

Containerize the application with Docker and run it on Cloud Run.

Answer

Migrate the database to Firestore and rewrite the application to use Firestore APIs.

Question 5

A developer notices that web-server-1 is preemptible. They want to ensure their application remains available even if this instance is terminated. What should they do?

Accepted Answer

Create a managed instance group for web-server-1 and set an autoscaler.. A managed instance group (MIG) with an autoscaler ensures that if the preemptible instance is terminated, the MIG automatically recreates it to maintain the desired number of instances. This provides resilience against preemption by restoring capacity without manual intervention. The load balancer can then distribute traffic across healthy instances in the group.

Answer

Modify the instance's preemptible flag to false.

Answer

Create a load balancer pointing to web-server-1's external IP.

Answer

Create a snapshot schedule for web-server-1.

Question 6

A security engineer needs to restrict access to a Google Cloud project so that only a specific set of IP addresses can reach Cloud Storage buckets. Which feature should be configured?

Accepted Answer

VPC Service Controls. VPC Service Controls creates a service perimeter around Google Cloud resources like Cloud Storage buckets, enforcing context-aware access based on attributes such as the source IP address of the caller. By defining an access level that includes only the specified IP ranges and binding it to the perimeter, requests from outside those IPs are denied even if the caller has valid IAM permissions. This is the only option that provides network-origin-based restriction at the project/service level for Cloud Storage.

Answer

IAM Conditions

Answer

Firewall Rules

Answer

Cloud Armor

Question 7

A company runs a global SaaS application on Google Cloud using Cloud Spanner. They need to ensure disaster recovery with a Recovery Time Objective (RTO) of less than 5 seconds and a Recovery Point Objective (RPO) of zero. Which configuration should they use?

Accepted Answer

Deploy Cloud Spanner in a multi-region configuration. Cloud Spanner multi-region configurations synchronously replicate data across regions using Paxos, giving an RPO of zero (no committed data is ever lost) and an RTO of seconds because a regional failure triggers automatic leader re-election without manual intervention. This is the only option that satisfies both the zero-RPO and sub-5-second RTO requirements simultaneously.

Answer

Enable point-in-time recovery (PITR)

Answer

Use read replicas in another region

Answer

Configure automated backups with a 1-hour backup frequency

Question 8

An engineer needs to list all Compute Engine instances in a project using the command line. Which gcloud command should they use?

Accepted Answer

gcloud compute instances list. The correct command to list Compute Engine instances is 'gcloud compute instances list'. The other options are incorrect: 'gcloud compute machine-types list' lists machine types, 'gcloud compute instance-groups list' lists instance groups, and 'gcloud compute instances describe' describes a specific instance.

Answer

gcloud compute instances describe

Answer

gcloud compute instance-groups list

Answer

gcloud compute machine-types list

Question 9

A company wants to deploy a microservices architecture on Google Cloud. They need a service mesh to manage traffic, security, and observability across services. They also want to run workloads on both GKE and Compute Engine. Which solution should they use?

Accepted Answer

Cloud Service Mesh (Anthos Service Mesh). Cloud Service Mesh (formerly Anthos Service Mesh) is Google's managed Istio distribution that provides traffic management, mTLS security, and observability, and it explicitly supports workloads on both GKE and Compute Engine via VM enrollment. It is the only option designed for a hybrid GKE + Compute Engine service mesh. Istio OSS on GKE alone does not natively extend to Compute Engine VMs without significant custom work, and Traffic Director is a control plane for load balancing, not a full service mesh with sidecar-based security and observability.

Answer

Cloud Run for Anthos

Answer

Istio open-source installation on GKE

Answer

Traffic Director

Question 10

A security team wants to audit all IAM role assignments in an organization. They need a historical record of changes. Which tool should they use?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify IAM policies, including role assignments. These logs are immutable and retained for the default retention period (400 days for Admin Activity logs), providing a historical record of changes. Cloud Asset Inventory (A) shows the current state but not historical changes, Access Transparency (B) logs Google staff access to your data, and Security Command Center (D) provides security findings and posture, not a change history.

Answer

Cloud Asset Inventory

Answer

Access Transparency

Answer

Security Command Center

Question 11

A company needs to connect their on-premises data center to Google Cloud with a dedicated, low-latency connection that provides a Service Level Agreement (SLA) of 99.99% uptime. They anticipate high bandwidth usage (10 Gbps). Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection between the on-premises data center and Google Cloud, offering high bandwidth (10 Gbps or 100 Gbps) and a 99.99% uptime SLA. It is the most appropriate choice for a dedicated, low-latency connection with high bandwidth requirements. Partner Interconnect also offers 99.99% SLA but is provided through a service provider and may not be dedicated; however, the question specifies 'dedicated' and 10 Gbps, which aligns with Dedicated Interconnect.

Answer

Cloud VPN with static routing

Answer

Cloud CDN

Answer

Partner Interconnect

Question 12

A company is migrating to Google Cloud and needs to implement a least-privilege access model. Which THREE Google Cloud services or features support this goal? (Choose three.)

Accepted Answer

Cloud IAM Conditions. Cloud IAM Conditions allow you to define and enforce attribute-based, context-aware access control policies on Google Cloud resources. By specifying conditions such as time, resource type, or IP address in IAM policies, you can grant temporary or scoped permissions, ensuring users have only the access necessary for their specific task. This directly supports least-privilege by reducing standing privileges and preventing over-permissioning.

Answer

Cloud Audit Logs

Answer

Cloud NAT

Question 13

A developer wants to deploy a Cloud Function that is triggered whenever a new object is created in a Cloud Storage bucket. Which trigger type should they choose?

Accepted Answer

Cloud Storage trigger. A Cloud Storage trigger is specifically designed to invoke a Cloud Function in response to object events in a Cloud Storage bucket, such as object creation (google.storage.object.finalize). This is the direct and native trigger type for 'new object created in a bucket' scenarios. It eliminates the need for additional event routing or polling.

Answer

Firestore trigger

Answer

Pub/Sub trigger

Answer

HTTP trigger

Question 14

A company is deploying a critical application on GKE and wants to ensure high availability during node upgrades and failures. Which TWO configurations should they implement? (Choose 2.)

Accepted Answer

Configure a PodDisruptionBudget for the deployment. Option B is correct because a PodDisruptionBudget (PDB) with minAvailable or maxUnavailable ensures that voluntary disruptions such as node drains during upgrades keep a minimum number of replicas running, preserving availability. Option C is correct because a multi-zonal node pool spreads nodes across multiple zones in the region, so a zone-level failure or maintenance event does not take down all nodes hosting the application's pods. Option A (Workload Identity) only maps Kubernetes service accounts to Google Cloud IAM identities for secure API access and does not affect availability during upgrades or failures. Option D (HorizontalPodAutoscaler) scales replicas based on load metrics but does not protect against node drains or zone outages. Option E (Cluster Autoscaler) adds or removes nodes based on pending pods and capacity, which helps with scaling but does not by itself guarantee availability during upgrades or zonal failures.

Answer

Enable Workload Identity for the service account

Answer

Use a HorizontalPodAutoscaler with high target utilization

Answer

Enable Cluster Autoscaler on the node pool

Question 15

A security team wants to enforce that only container images signed by their internal CI/CD pipeline can run on GKE clusters. They also need to ensure that unsigned images are rejected at admission time. Which combination of services and configurations should they use?

Accepted Answer

Binary Authorization with Cloud KMS for signing. Binary Authorization is the GKE feature that enforces admission-time policies requiring container images to be signed by trusted authorities. Cloud KMS provides the signing keys used by the CI/CD pipeline to create attestations. Together they ensure only images signed by the internal pipeline are admitted to the cluster.

Answer

GKE PodSecurityPolicy with allowed registries

Answer

Cloud Build with Container Analysis

Answer

Artifact Registry vulnerability scanning and IAM roles