Google PCA Practice Test 42 — 15 Questions

Question 1

A data scientist needs read-only access to a Cloud Storage bucket containing training data. What is the least privileged IAM role to grant at the bucket level?

Accepted Answer

roles/storage.objectViewer. Roles/storage.objectViewer grants read-only access to objects in a Cloud Storage bucket without allowing any write or administrative actions. This is the least privileged role that satisfies the requirement for read-only access to training data at the bucket level, as it only permits storage.objects.get and storage.objects.list permissions.

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectCreator

Answer

roles/storage.admin

Question 2

A DevOps team wants to automate the deployment of infrastructure on Google Cloud using a declarative configuration language. They need to support Python and Jinja templates for reusable modules. Which service should they use?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager is Google Cloud's native infrastructure as code service that uses declarative YAML or Python/Jinja templates. It supports Python and Jinja templates for reusable modules, making it the correct choice for automating infrastructure deployment with those requirements.

Answer

Config Connector

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 3

A company is deploying a web application on Compute Engine. They want to ensure that only authenticated users can access the application. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy. Identity-Aware Proxy (IAP) is the correct choice because it enforces access control at the edge of Google's network, verifying user identity and context before allowing traffic to reach the Compute Engine instance. IAP uses OAuth 2.0 and signed headers to authenticate users, ensuring only authorized requests are forwarded to the backend, without requiring any changes to the application itself.

Answer

Cloud Load Balancing

Answer

Cloud CDN

Answer

Cloud DNS

Question 4

A team is deploying a microservice on Cloud Run that needs to access a Cloud SQL database securely. They want to avoid using public IPs and ensure traffic stays within Google's network. Which configuration should they use?

Accepted Answer

Use Serverless VPC Access and assign a private IP to the Cloud SQL instance. To keep Cloud Run traffic private and avoid public IPs, you use Serverless VPC Access to connect the Cloud Run service to a VPC, and the Cloud SQL instance is configured with a private IP in that VPC. This keeps all traffic within Google's network and avoids exposing the database publicly. The connector allows the serverless service to reach internal resources by IP.

Answer

Configure Cloud SQL with a public IP and use Cloud SQL Proxy in the Cloud Run service

Answer

Enable Private Google Access on the VPC subnet

Answer

Create a VPC network peering between the Cloud Run tenant project and the Cloud SQL project

Question 5

A financial services company requires that all audit logs be retained for 7 years in a cost-effective, immutable storage. They also need to run ad-hoc SQL queries on the logs. Which configuration should they use?

Accepted Answer

Create two log sinks: one to BigQuery for querying, and one to Cloud Storage with object retention policy for immutable storage. The requirement has two parts: immutable 7-year retention and ad-hoc SQL querying. A dual-sink approach satisfies both: one sink to BigQuery for SQL analysis, and one sink to Cloud Storage with an object retention policy (or bucket lock) for immutable, cost-effective long-term storage. This separates query and archival concerns while meeting compliance.

Answer

Create a log sink to BigQuery with a 7-year partition expiration and use BigQuery's SQL capabilities

Answer

Use Cloud Logging's default retention and set up a log-based metric to trigger a Cloud Function that copies logs to BigQuery

Answer

Export logs to Cloud Storage with a retention policy set to 7 years and use Cloud Storage SQL interface

Question 6

A company is migrating to Google Cloud and needs to connect their on-premises network to a VPC. They require high bandwidth and a reliable connection with a Service Level Agreement (SLA). Which solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google's network, offering high bandwidth (10 or 100 Gbps per link) and a 99.99% uptime SLA when configured with redundant links. This meets the requirements for high bandwidth and a reliable, SLA-backed connection better than any other option.

Answer

Cloud VPN with dynamic routing

Answer

Partner Interconnect via a service provider

Answer

Direct Peering

Question 7

An organization wants to manage DNS records for a domain they own (e.g., example.com) and use Google Cloud for authoritative DNS. They also need to resolve internal hostnames for resources within their VPC. Which Cloud DNS configuration should they use?

Accepted Answer

Create a public managed zone for example.com and a private managed zone for internal VPC resources. To serve authoritative public DNS for example.com and resolve internal VPC hostnames, the correct design is a public managed zone for example.com and a separate private managed zone associated with the VPC for internal names. This separation ensures public queries resolve to public records while internal queries resolve to private records, and it avoids exposing internal names publicly.

Answer

Create a single public managed zone and use DNS peering for internal resolution

Answer

Create a single private managed zone for both external and internal DNS resolution

Answer

Use Google Groups DNS to manage both public and private records

Question 8

Which GCP service provides distributed tracing to help analyze latency in microservices applications?

Accepted Answer

Cloud Trace. Cloud Trace is Google Cloud's distributed tracing service, designed to collect latency data across microservices and display it as traces and spans. It helps identify performance bottlenecks in distributed applications. Cloud Profiler, Logging, and Monitoring serve different observability roles and do not provide distributed tracing.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 9

An engineer is troubleshooting a Cloud Build trigger that fails with the error 'PERMISSION_DENIED: Cloud Build service account does not have permission to access Artifact Registry'. The build needs to push a Docker image to Artifact Registry. What is the correct IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/artifactregistry.writer. Cloud Build's service account needs to push images to Artifact Registry, which requires write access to repositories. The predefined role roles/artifactregistry.writer grants exactly the permissions needed to upload and delete artifacts (including Docker image push) within Artifact Registry repositories. Assigning this role to the Cloud Build service account resolves the PERMISSION_DENIED error while following least privilege.

Answer

roles/artifactregistry.viewer

Answer

roles/editor

Answer

roles/storage.objectAdmin

Question 10

A developer needs to store a database password securely and access it from a Cloud Run service. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is Google Cloud's dedicated service for storing, managing, and accessing sensitive data such as API keys, passwords, and certificates. It provides versioning, IAM-based access control, audit logging, and automatic rotation, and Cloud Run can mount secrets as environment variables or volumes. This makes it the correct choice for storing a database password securely.

Answer

Cloud Storage

Answer

Firestore

Answer

Cloud KMS

Question 11

An organization has multiple GCP projects managed by a central operations team. They want to define a common VPC configuration in a host project and allow service projects to use it. Which networking feature should they use?

Accepted Answer

Shared VPC. Shared VPC allows an organization to designate a host project that owns the VPC network and subnets, and then attach service projects so their resources (VMs, GKE clusters, etc.) can use that shared network. This centralizes network administration under the operations team while letting service teams deploy workloads in their own projects. It is the canonical GCP feature for exactly this host-project/service-project pattern.

Answer

Private Service Connect

Answer

Cloud VPN

Answer

VPC peering

Question 12

A development team wants to automate the process of building container images from their GitHub repository and storing them in Artifact Registry. Which Google Cloud service should they use to create a build trigger that runs on every push to the main branch?

Accepted Answer

Cloud Build. Cloud Build is the correct service because it provides build triggers that can be configured to automatically build container images from source repositories like GitHub. When a push to the main branch occurs, Cloud Build can execute a build using a Dockerfile or buildpack, and then push the resulting image to Artifact Registry. This directly addresses the requirement to automate image building and storage.

Answer

Container Registry

Answer

Artifact Registry

Answer

Cloud Deploy

Question 13

A company runs a stateful application on GKE that requires persistent storage. They want to ensure that during cluster upgrades, pods are not disrupted and storage is preserved. Which configuration should they use?

Accepted Answer

Use a StatefulSet with a PodDisruptionBudget. To ensure stateful pods are not disrupted during cluster upgrades and storage is preserved, you should use a StatefulSet with a PodDisruptionBudget (PDB). StatefulSets provide stable network identities and persistent storage for stateful applications, while PDBs ensure that a minimum number of pods remain available during voluntary disruptions like upgrades.

Answer

Enable Cluster Autoscaler on the node pool

Answer

Use a Deployment with a HorizontalPodAutoscaler

Answer

Use PersistentVolumeClaims with ReadWriteMany access mode

Question 14

You want to monitor the latency of an application running on Compute Engine and create an alert if the 99th percentile latency exceeds 500ms for more than 5 minutes. Which approach should you use?

Accepted Answer

Create a Metric Threshold alert using the 'Latency' metric with a percentile alignment. To monitor latency and alert on the 99th percentile exceeding 500ms for more than 5 minutes, you should create a Metric Threshold alert in Cloud Monitoring using the appropriate latency metric (e.g., from a load balancer or application) with a percentile alignment. This allows you to aggregate latency data over a window and trigger an alert when the condition is met.

Answer

Use Cloud Trace to analyze latency and set a trace-based alert

Answer

Use Error Reporting to capture latency errors

Answer

Create a log-based metric from application logs and set an alert on that metric

Question 15

An engineer wants to store a database password securely and allow a Cloud Run service to access it. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to securely store and manage sensitive data like database passwords, API keys, and certificates. It provides versioning, access control, and audit logging, and integrates with Cloud Run to inject secrets as environment variables or mounted volumes.

Answer

Cloud Storage

Answer

Cloud Key Management Service (KMS)

Answer

Firestore