Google PCA Practice Test 41 — 15 Questions

Question 1

An organization requires that all Compute Engine instances in a project must have a specific tag for firewall rule compliance. How can they enforce this?

Accepted Answer

Use a mandatory tag via organization policy. Organization Policies in Google Cloud can enforce constraints that require resources, including Compute Engine instances, to have specific labels or tags. The `compute.requireOsLogin` or custom constraint `compute.requireInstanceTag` can be used to mandate that all instances must have a particular tag, and any instance creation that violates this policy will be denied at the API level, ensuring compliance without relying on user behavior.

Answer

Use IAM roles to restrict instance creation

Answer

Use a startup script to add the tag

Answer

Use Cloud Asset Inventory

Question 2

A company has a production GKE cluster with a node pool using n1-standard-4 machine types. They need to change to e2-standard-4 without downtime. Which approach should be taken?

Accepted Answer

Create a new node pool with the new machine type, cordon and drain old nodes, then delete the old pool.. It ensures zero downtime by first creating a new node pool with the desired e2-standard-4 machine type, then cordoning and draining the old nodes to gracefully migrate workloads, and finally deleting the old pool. This approach leverages Kubernetes' native pod eviction and rescheduling mechanisms to maintain application availability throughout the migration.

Answer

Enable GKE Node Auto-Repair to automatically fix the issue.

Answer

Delete the existing node pool and create a new one with the new machine type.

Answer

Update the existing node pool's machine type via gcloud container node-pools update.

Answer

Use gcloud compute machine-types change on the nodes.

Question 3

A company wants to monitor the health of their Cloud Run services. Which THREE metrics should they use to define a comprehensive health SLI? (Choose 3)

Accepted Answer

Latency (e.g., p99 response time). Latency (p99 response time) is a critical metric for Cloud Run because it measures the end-to-end request processing time, directly reflecting user experience. In a serverless environment, high latency can indicate cold starts, insufficient concurrency, or downstream service bottlenecks, making it essential for a comprehensive health SLI.

Answer

CPU utilization

Answer

Instance count

Question 4

An organization wants to connect their on-premises data center to Google Cloud with a dedicated 10 Gbps link. They require high availability and have budget for two physically diverse connections. Which solution should they choose?

Accepted Answer

Provision two Cloud Dedicated Interconnect connections from diverse peering points.. Cloud Dedicated Interconnect provides direct physical connections between on-premises and Google Cloud. For high availability, two separate circuits (each 10 Gbps or 100 Gbps) from diverse peering points are recommended. HA VPN is software-defined and lower bandwidth. Partner Interconnect uses a service provider but Dedicated Interconnect is preferred for dedicated bandwidth.

Answer

Use Partner Interconnect with a single 10 Gbps connection.

Answer

Configure a single Dedicated Interconnect connection and use Cloud VPN as backup.

Answer

Deploy a single HA VPN tunnel.

Question 5

Your company runs a critical application on Compute Engine instances in us-central1. The application requires low latency between instances that are all in the same region. You notice that network latency between instances varies and sometimes spikes. You want to ensure consistent low-latency communication. You currently use external IP addresses for communication between instances. What should you do?

Accepted Answer

Use internal IP addresses instead of external IPs for inter-instance communication.. Using internal IP addresses (RFC 1918) for inter-instance communication avoids the overhead of NAT, external routing, and potential egress bottlenecks. Traffic stays within Google's internal network fabric, reducing latency variability and eliminating spikes caused by external internet path fluctuations.

Answer

Move instances to the same zone to reduce network hops.

Answer

Upgrade to larger machine types to improve network bandwidth.

Answer

Set up a Cloud VPN connection between instances.

Question 6

An engineer runs the command above. A few days later, the instance becomes unresponsive. Upon investigation, you find that the boot disk is 100 GB and 95% full. The data disk is 500 GB and only 20% full. What is the most likely cause of the unresponsiveness?

Accepted Answer

The boot disk is too small and has run out of space.. The boot disk is 95% full, which leaves insufficient free space for the operating system to write temporary files, logs, or perform essential system operations. When a Linux or Windows boot disk runs out of space, the OS can become unresponsive because critical processes (e.g., systemd, journald, or the Windows Registry) cannot write to disk. In Google Cloud, the boot disk is the root device (typically /dev/sda1), and filling it to 95% on a 100 GB disk means only 5 GB remains, which is easily exhausted by normal system activity.

Answer

The data disk is pd-standard, which is causing I/O bottlenecks for the OS.

Answer

The boot disk is pd-ssd, which is too slow for the workload.

Answer

The instance has run out of IOPS on the boot disk.

Question 7

A company stores sensitive customer data in Cloud Storage buckets. They want to ensure that access to these buckets is only allowed from within their VPC network. Which configuration should they use?

Accepted Answer

VPC Service Controls with a service perimeter. D is correct because VPC Service Controls (VPC-SC) allow you to define a service perimeter that restricts access to Google Cloud Storage (and other managed services) to only requests originating from a specified VPC network. This ensures that data exfiltration and unauthorized access from outside the VPC are blocked, even if the bucket is publicly accessible or IAM allows broader access.

Answer

Bucket IAM policies with condition on service account

Answer

Cloud Armor WAF rules

Answer

Private Google Access for on-premises

Question 8

An organization uses Cloud Deployment Manager to manage infrastructure as code. They need to ensure that changes to production resources are reviewed and approved before deployment. What should they do?

Accepted Answer

Integrate Cloud Deployment Manager with Cloud Build and add a manual approval step in the Cloud Build pipeline. Integrating Cloud Deployment Manager with Cloud Build allows you to create a CI/CD pipeline that includes a manual approval step. This ensures that changes to production resources are reviewed and approved before the deployment config is applied, meeting the requirement for change control.

Answer

Use Cloud Scheduler to run deployment configs and review logs after deployment

Answer

Create a Cloud Deployment Manager preview deployment and manually approve it

Answer

Use Cloud Build with a trigger on a branch that requires pull request approval before merging

Question 9

Which TWO actions reduce egress costs when transferring data from Compute Engine to the internet? (Choose 2)

Accepted Answer

Use Cloud CDN to cache content. Cloud CDN caches content at edge locations, reducing the amount of data served from the origin Compute Engine instance, thus lowering egress costs. Compressing data before transfer reduces the volume of data sent, directly decreasing egress costs. Cloud NAT does not affect egress costs; it only provides outbound connectivity. Moving instances to a lower-cost region does not reduce egress costs because egress pricing is similar across regions. Premium Tier networking typically increases costs due to higher per-GB charges.

Answer

Use Cloud NAT for outbound traffic

Answer

Move instances to a lower-cost region

Answer

Use Premium Tier networking

Question 10

A company wants to reduce Google Cloud costs for a batch processing workload. They currently use n1-standard-4 VMs running 24/7. The workload runs for 2 hours each night. What is the most cost-effective recommendation?

Accepted Answer

Use preemptible VMs with a startup script and persistent disk.. D is correct because the workload runs for only 2 hours per night, making preemptible VMs ideal — they cost up to 80% less than on-demand VMs and can be terminated at any time. A startup script ensures the job resumes if the VM is preempted, and using a persistent disk preserves data across interruptions. This combination provides the lowest cost for a short, fault-tolerant batch job.

Answer

Use on-demand VMs and rely on sustained use discounts.

Answer

Use a custom machine type with fewer vCPUs.

Answer

Use committed use discounts for 1 year.

Question 11

A company is moving a legacy application to Google Cloud. The application uses a PostgreSQL database and must be re-platformed with minimal code changes. They require high availability across zones and automatic failover within the same region. Which TWO database services meet these requirements? (Choose 2.)

Accepted Answer

AlloyDB for PostgreSQL. Cloud SQL for PostgreSQL provides regional high availability with automatic failover across zones. AlloyDB is PostgreSQL-compatible, offers high availability with a primary and standby instance, and is optimized for performance. Cloud Spanner is globally distributed but requires more code changes. Bigtable is not PostgreSQL-compatible. Firestore is NoSQL.

Answer

Firestore

Answer

Cloud Bigtable

Answer

Cloud Spanner

Question 12

Alice needs to read objects in the bucket 'secret-bucket'. Based on the IAM policy, what is her effective access?

Accepted Answer

Alice can read objects because objectAdmin grants read access and is not denied.. The IAM policy grants Alice the objectAdmin role, which includes read access to objects in the bucket. The deny rule specifically removes the objectViewer role, but objectAdmin is a separate role that provides its own read permissions. Since the deny does not explicitly target objectAdmin, the allow binding for objectAdmin remains effective, giving Alice read access.

Answer

Alice cannot read objects because the deny rule overrides all allow bindings.

Answer

Alice can read objects only if she also has objectCreator role.

Answer

Alice cannot read objects because the deny rule removes objectViewer and she has no other read access.

Question 13

Which THREE are valid Google Cloud Dedicated Interconnect connection options?

Accepted Answer

High availability (HA) with two 10 Gbps circuits.. Google Cloud Dedicated Interconnect supports high availability configurations using two 10 Gbps circuits to provide redundancy and meet SLA requirements. This setup ensures that if one circuit fails, traffic can be rerouted through the other, maintaining connectivity.

Answer

IPsec VPN tunnel as a backup to the interconnect.

Answer

Partner Interconnect offering via a service provider.

Question 14

Which THREE of the following are best practices when using Deployment Manager to manage infrastructure? (Choose three.)

Accepted Answer

Use templates to define resources modularly.. Using templates promotes reusability and modularity. Imports allow you to define common resources across deployments. Composite types bundle related resources into a single entity. YAML files are basic, but using Python or Jinja allows dynamic generation. The three best practices are using templates, imports, and composite types.

Answer

Use raw REST API calls in templates.

Answer

Use only YAML configuration files.

Question 15

Which TWO statements are true about Cloud Load Balancing?

Accepted Answer

Regional load balancing supports TCP/UDP traffic.. Regional load balancing (such as the external regional TCP/UDP Network Load Balancer) operates at Layer 4 and supports TCP and UDP traffic, making option B correct. Additionally, global load balancers like the external HTTP(S), SSL Proxy, and TCP Proxy load balancers can be associated with instance groups in multiple regions, allowing traffic distribution across regions for high availability and low latency. This makes option E correct. Options A, C, and D are incorrect because: A – not all load balancers require a regional forwarding rule (e.g., global load balancers use a global forwarding rule); C – global load balancers support not only HTTP/S but also TCP and UDP via the SSL Proxy and TCP Proxy load balancers; D – internal load balancing can also span across peered VPCs, not just the same VPC.

Answer

All load balancers require a regional forwarding rule.

Answer

Global load balancing supports only HTTP/S traffic.

Answer

Internal load balancing is only for traffic within the same VPC.