Google PCA Practice Test 41 — 15 Questions

Question 1

A Cloud Run service frequently fails with 502 errors when making requests to a backend service running on Compute Engine. The two services are in the same VPC network. The Cloud Run service is configured with a VPC connector. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC connector is not attached to the correct subnet, or the firewall rules are blocking traffic from the connector's IP range.. Cloud Run uses a VPC connector to send requests to resources in a VPC. If the connector is attached to the wrong subnet, its egress traffic may not reach the Compute Engine instance, or firewall rules may block traffic from the connector's IP range (e.g., 10.8.0.0/28). This results in 502 errors from the backend, as the Cloud Run service cannot establish a TCP connection to the Compute Engine instance.

Answer

The Cloud Run service needs to be peered with the VPC using VPC Network Peering.

Answer

The VPC connector is set to a low number of instances, causing traffic throttling.

Answer

The Cloud Run service's service account lacks the roles/compute.instanceAdmin role.

Question 2

A company uses Shared VPC. A project admin in a service project tries to create a subnet in the shared VPC network but receives a permission denied error. What is the most likely cause?

Accepted Answer

The service project admin lacks the compute.subnetworks.create permission on the host project.. In a Shared VPC architecture, subnet creation is a privileged operation that can only be performed by a user with the compute.subnetworks.create permission on the host project. The service project admin, by default, does not have this permission in the host project, which is why the permission denied error occurs. Granting this permission to the service project admin at the host project level would resolve the issue.

Answer

Only the Shared VPC host project admin can create subnets.

Answer

The Shared VPC is not enabled for the service project.

Answer

Subnets must be created in the service project, not the host project.

Question 3

A security team needs to detect and redact personally identifiable information (PII) in documents stored in Cloud Storage before sharing them with external partners. Which two Google Cloud services should they use together? (Choose two.)

Accepted Answer

Cloud Data Loss Prevention (DLP) API. The Cloud Data Loss Prevention (DLP) API (A) is the correct service for detecting and redacting personally identifiable information, since it provides infoType detectors and de-identification transforms such as redaction, masking, and tokenization that can scan and sanitize sensitive data. Cloud Storage (B) is also correct because the documents being scanned and shared reside in Cloud Storage buckets, and DLP integrates directly with Cloud Storage to inspect and de-identify objects in place or on export. Together, DLP performs the PII detection and redaction while Cloud Storage holds the source and destination documents, matching the scenario's requirement to sanitize files before external sharing. Cloud KMS (C) only manages encryption keys and cannot detect or redact PII content. Cloud Dataflow (D) is a data processing pipeline service that could orchestrate jobs but does not itself provide PII detection or redaction logic. Cloud NAT (E) is a networking service for outbound internet access and is unrelated to data inspection or redaction.

Answer

Cloud KMS

Answer

Cloud Dataflow

Answer

Cloud NAT

Question 4

A company is migrating a monolithic application to microservices on Google Cloud. They need to manage service-to-service authentication and authorization. Which service should they use?

Accepted Answer

Service Mesh (Anthos). Service Mesh (Anthos) provides a dedicated infrastructure layer for managing service-to-service communication, including mutual TLS (mTLS) authentication, fine-grained authorization policies, and observability. It uses sidecar proxies (Envoy) to intercept traffic and enforce security policies without modifying application code, making it ideal for microservices authentication and authorization.

Answer

Cloud NAT

Answer

Cloud Identity-Aware Proxy

Answer

Cloud Endpoints

Question 5

A startup is migrating a monolithic application to Google Cloud. They want to minimize operational overhead and auto-scale based on HTTP request load. Which compute solution should they choose?

Accepted Answer

Cloud Run. Cloud Run is the best choice because it is a fully managed serverless platform that automatically scales from zero based on HTTP request load, minimizing operational overhead. It abstracts away infrastructure management, supports containerized applications, and charges only for resources used during request processing, aligning perfectly with the requirement to auto-scale based on HTTP traffic.

Answer

Compute Engine managed instance groups with autoscaling

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Functions

Question 6

A financial services company needs a globally distributed relational database that supports strong consistency across regions, with multi-region writes and sub-10ms latency for most queries. The database must also support SQL and ACID transactions. Which database should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that offers global distribution, strong consistency, multi-region writes, SQL support, and ACID transactions. Cloud SQL is single-region. Bigtable is NoSQL and does not support SQL or ACID. Firestore is NoSQL with limited transactional support.

Answer

Cloud SQL

Answer

Firestore

Answer

Bigtable

Question 7

The exhibit shows a managed instance group configuration. What is the primary purpose of the 'autoHealingPolicies' section?

Accepted Answer

Automatically replace instances that are deemed unhealthy based on the health check.. The 'autoHealingPolicies' section in a managed instance group configuration is specifically designed to automatically replace instances that are deemed unhealthy based on a configured health check. When a health check probe (e.g., HTTP, TCP, or SSL) fails for a sustained period, the managed instance group terminates the unhealthy instance and creates a new one from the instance template, ensuring the desired number of healthy instances is maintained. This is distinct from autoscaling, which adjusts instance count based on load metrics.

Answer

Distribute incoming traffic evenly across the instances.

Answer

Automatically add more instances when CPU utilization exceeds 60%.

Answer

Automatically update instances to a new instance template.

Question 8

A healthcare organization is storing sensitive patient data in Cloud Storage. They need to ensure that all objects are encrypted with a key managed by their on-premises HSM. Which encryption approach should they use?

Accepted Answer

Use Cloud External Key Manager (EKM) with a key hosted on the on-premises HSM.. Cloud External Key Manager (EKM) allows you to use an external key management system, such as an on-premises HSM, to manage encryption keys for Google Cloud services. This approach meets the requirement because the key never leaves the HSM, and Cloud Storage uses the key via the EKM integration, ensuring the organization retains full control over the key lifecycle.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and store the key in a Secret Manager accessible only from the on-premises HSM.

Answer

Use Customer-Managed Encryption Keys (CMEK) with a Cloud KMS key that is generated from the on-premises HSM.

Answer

Encrypt each object client-side with a key from the on-premises HSM before uploading to Cloud Storage.

Question 9

Your organization stores critical financial data in Cloud Storage. You need to ensure that if an object is deleted or overwritten, you can recover it within 30 days. What feature should you enable?

Accepted Answer

Enable object versioning on the bucket. Object versioning preserves every version of an object, including prior versions created before an overwrite and the last version before deletion. When an object is deleted, a delete marker is placed, but the underlying versions remain recoverable. This directly satisfies the requirement to recover deleted or overwritten objects within 30 days.

Answer

Set a retention policy with a 30-day retention period

Answer

Configure lifecycle management to delete objects after 30 days

Answer

Enable Bucket Lock with a retention policy

Question 10

A company is designing a highly available architecture for a web application using Google Cloud. They need to ensure that the application remains available even if an entire Google Cloud region experiences an outage. Which THREE components should they include in their architecture? (Choose THREE.)

Accepted Answer

Cloud Spanner multi-region configuration. Option A (Cloud Spanner multi-region configuration) is correct because a multi-region instance replicates data synchronously across regions with 99.999% availability, so the database survives a full regional outage without data loss. Option C (Global external HTTP(S) load balancer) is correct because it is a global anycast service that routes users to the nearest healthy backend and automatically fails over to backends in other regions when one region becomes unavailable. Option E (Regional managed instance groups in multiple regions) is correct because deploying regional MIGs in at least two regions provides compute capacity that keeps serving traffic when one region fails, and it pairs with the global load balancer for automatic failover. Option B is not sufficient because Cloud SQL cross-region read replicas are asynchronous and require manual or scripted promotion, so they do not provide automatic, zero-data-loss regional failover. Option D is not correct because Cloud CDN only caches content at edge locations; it improves latency and offloads origin traffic but does not by itself provide regional failover for dynamic application workloads.

Answer

Cloud SQL with a cross-region read replica

Answer

Cloud CDN

Question 11

A Cloud Run service needs to access resources in a VPC network (e.g., a Cloud SQL instance). The service should be able to send requests to the VPC and receive responses. What is the correct configuration?

Accepted Answer

Create a VPC connector and configure the Cloud Run service to use it for egress. Cloud Run services run outside the customer's VPC by default, so to reach private VPC resources like a Cloud SQL instance with a private IP, you must attach a Serverless VPC Access connector. The connector provides a bridge from the serverless environment into the specified VPC network and subnet, allowing outbound requests to private IPs and return traffic. Configuring the service to use the connector for egress (all traffic or private ranges only) is the documented, supported pattern for this requirement.

Answer

Place the Cloud Run service in a VPC subnet

Answer

Use Cloud NAT to allow Cloud Run to access the VPC

Answer

Use VPC peering between Cloud Run and the VPC

Question 12

A cloud architect needs to implement a CI/CD pipeline for a team developing a Python-based microservice. The team uses GitHub as their source repository. The pipeline should automatically run unit tests and deploy the service to Cloud Run when changes are pushed to the main branch. Which THREE Google Cloud services should they use?

Accepted Answer

Artifact Registry. Cloud Build (E) is the correct CI/CD engine here: it can be triggered by GitHub pushes to the main branch, run the Python unit tests in a build step, and then deploy the resulting container to Cloud Run. Artifact Registry (A) is needed to store and version the container images that Cloud Build builds, since Cloud Run pulls its images from a registry rather than building them itself. Cloud Run (B) is the target compute platform for the microservice, hosting the containerized Python service that the pipeline deploys. Cloud Deploy (C) is not required because it is a managed continuous-delivery service for GKE and Cloud Run that adds release/pipeline abstractions, which is unnecessary for this simple test-and-deploy flow. Cloud Source Repositories (D) does not belong because the team already uses GitHub as its source repository, so a second Google-hosted Git repo is redundant.

Answer

Cloud Deploy

Answer

Cloud Source Repositories

Question 13

A company wants to run containerized applications on Google Cloud with minimal operational overhead. They prefer to use a serverless container platform. Which TWO compute options should they consider? (Choose 2.)

Accepted Answer

GKE Autopilot. GKE Autopilot (D) is correct because it is a fully managed, serverless-style Kubernetes mode in which Google provisions and manages the nodes, scaling, and cluster infrastructure, letting the company run containerized workloads with minimal operational overhead. Cloud Run (fully managed) (E) is correct because it is a serverless container platform that abstracts away all infrastructure, scales automatically (including to zero), and bills only for resources used, directly matching the requirement to run containers with minimal operations. Compute Engine (A) is not appropriate because it provides raw VMs that the company must patch, scale, and manage itself, which is high operational overhead and not serverless. GKE Standard (B) is not the best fit because, although it runs containers, the company remains responsible for node pools, upgrades, and cluster operations. Cloud Functions (C) is incorrect because it runs event-driven functions rather than arbitrary containerized applications, so it does not satisfy the containerized-application requirement.

Answer

Compute Engine

Answer

GKE Standard

Answer

Cloud Functions

Question 14

A company runs batch processing jobs nightly that can tolerate interruptions. They want to minimize compute costs for these jobs. Which Compute Engine machine type and provisioning model is most cost-effective?

Accepted Answer

Preemptible VMs with custom machine types. Preemptible VMs are up to 80% cheaper than standard VMs and are ideal for fault-tolerant, interruptible batch jobs. Custom machine types allow tailoring CPU and memory to the workload, avoiding over-provisioning and further reducing cost.

Answer

E2 custom VMs with sole-tenant nodes

Answer

N2 standard VMs with committed use discounts

Answer

GPU-accelerated VMs

Question 15

A developer wants to store and retrieve non-relational data with flexible schema and automatic scaling. Which Google Cloud service should they use?

Accepted Answer

Firestore.. Firestore is a NoSQL document database that supports flexible schema and automatic scaling, making it ideal for non-relational data. It offers real-time synchronization, offline support, and serverless scaling, which aligns with the requirement for storing and retrieving data without manual sharding or capacity planning.

Answer

Cloud Bigtable.

Answer

Cloud SQL.

Answer

Cloud Spanner.