Google PCA Practice Test 42 — 15 Questions

Question 1

Match each GCP data processing service to its use case.

Accepted Answer

Dataflow: Unified stream and batch data processing using Apache Beam. Dataflow is for unified stream/batch processing, Dataproc manages Spark/Hadoop, BigQuery is a serverless data warehouse, Pub/Sub is for messaging. Common confusions include mixing Dataflow with Dataproc and BigQuery with Pub/Sub.

Answer

Dataflow: Managed Spark and Hadoop clusters

Answer

BigQuery: Asynchronous messaging service

Question 2

Which TWO strategies should a company implement to optimize costs for a production GKE cluster? (Choose two.)

Accepted Answer

Enable GKE usage metering.. GKE usage metering provides detailed cost allocation by breaking down cluster resource consumption (CPU, memory, storage) per Kubernetes namespace or label, enabling teams to track and optimize spending across different projects or departments. Option D is correct because using cluster autoscaler with preemptible node pools reduces costs: the autoscaler adjusts the number of nodes based on workload demand, preventing over-provisioning, while preemptible VMs offer significant discounts (up to 60-91%) compared to regular instances, though they can be terminated at any time, making them suitable for fault-tolerant workloads.

Answer

Use Istio for traffic management.

Answer

Use a regional cluster.

Answer

Use node local DNS cache.

Question 3

Which TWO actions are required to allow a private GKE cluster to pull container images from Artifact Registry in the same project?

Accepted Answer

Enable Private Google Access on the subnet where the GKE nodes are deployed.. Private Google Access enables GKE nodes with only internal IP addresses to reach Google APIs and services, including Artifact Registry, over Google's private network rather than the public internet. Option E is correct because the GKE node's service account must have the Artifact Registry Reader role (roles/artifactregistry.reader) to authenticate and pull container images from the registry.

Answer

Create a firewall rule allowing outbound traffic to Artifact Registry IP ranges.

Answer

Set up VPC Network Peering with the Artifact Registry service.

Answer

Configure Cloud NAT for the GKE cluster.

Question 4

A company has deployed a critical application on Google Kubernetes Engine (GKE) with a Regional cluster (us-central1). The application uses a Cloud SQL for PostgreSQL database with a cross-region replica for disaster recovery. The SRE team needs to ensure that the application can survive a regional outage with minimal data loss. Which TWO actions should the team take to improve the reliability of the solution?

Accepted Answer

Configure the application to automatically promote the Cloud SQL cross-region replica to a primary instance when the primary region is unavailable.. To survive a regional outage with minimal data loss, two key actions are needed: (1) Automate promotion of the Cloud SQL cross-region replica to primary when the primary region fails (Option A) – this is the standard Cloud SQL DR procedure; automation via Cloud Functions/Cloud Run reduces RTO. Note that cross-region replication is asynchronous, so some data loss (replication lag) is possible. (2) Deploy a multi-region GKE cluster pair (primary and secondary) and use an external HTTP(S) load balancer with a backend service pointing to both clusters, combined with a DNS failover policy (Option C) – this allows the load balancer to detect primary region health and route traffic to the secondary region if needed. Options B is wrong because cross-region replication cannot be synchronous. Option D is wrong because a secondary cluster in the same region does not help during a regional outage. Option E is wrong because a TCP/UDP load balancer with latency-based routing does not provide failover based on region health.

Answer

Configure Cloud SQL cross-region replication to be synchronous to ensure zero data loss during failover.

Answer

Deploy a secondary GKE cluster in the same region as the primary to provide a hot standby that can take over immediately.

Answer

Use a TCP/UDP load balancer to route traffic to both regions based on latency.

Question 5

A company uses Cloud Armor to protect their HTTP load balancer. They need to block traffic from a specific set of IP addresses and also prevent SQL injection attacks. Which two configurations should they use? (Choose TWO.)

Accepted Answer

Security policies with IP deny rules. Cloud Armor security policies allow you to create IP deny rules to block traffic from specific IP addresses or ranges at the edge of Google's network, before it reaches your load balancer. Option E is correct because Cloud Armor also provides preconfigured WAF rules, including SQL injection detection, which can be added to the same security policy to inspect HTTP/HTTPS requests and block malicious payloads.

Answer

IAM roles to restrict access

Answer

Firewall rules on the VM instances

Answer

Ingress rules on the VPC network

Question 6

A company wants to enable a new DevOps team to have read-only access to logs in the default Cloud Logging bucket for their project, but prevent them from modifying log views or creating linked datasets in BigQuery. Which two IAM roles should be granted to the team?

Accepted Answer

roles/logging.viewAccessor. The roles/logging.viewAccessor role grants read-only access to log entries in Cloud Logging buckets, including the default bucket, without allowing modifications to log views or linked datasets. The roles/logging.viewer role provides broader read-only access to all Logging resources, including logs, but still prevents modifying log views or creating linked datasets in BigQuery. Together, these two roles satisfy the requirement of read-only log access while explicitly excluding permissions to alter log views or manage BigQuery linked datasets.

Answer

roles/logging.configWriter

Answer

roles/logging.admin

Answer

roles/bigquery.dataViewer

Question 7

Your organization uses Cloud SQL for MySQL to host a production database. The database size is 500 GB. You need to create a read replica for reporting purposes. The read replica should be in a different region for disaster recovery. You have created the read replica in the us-west1 region. However, the replication lag is higher than expected, sometimes exceeding 5 minutes. What should you do to reduce replication lag?

Accepted Answer

Upgrade the primary instance to a higher machine type with more CPU and memory.. Replication lag in Cloud SQL for MySQL is often caused by the primary instance being unable to keep up with the write workload, especially when the replica is in a different region. Upgrading the primary to a higher machine type with more CPU and memory increases its capacity to process transactions and generate binary logs, reducing the backlog that causes lag. This directly addresses the root cause of high replication lag, unlike other options that target unrelated aspects.

Answer

Configure an external read replica using MySQL binary log replication.

Answer

Increase the disk size of the read replica.

Answer

Decrease the backup window on the primary instance.

Question 8

A company is using Cloud NAT to allow instances in a private subnet to access the internet for updates. The security team wants to audit outbound connections. Which TWO steps should be taken to enable flow logs for Cloud NAT?

Accepted Answer

Configure a log sink to export Cloud NAT logs to BigQuery. Cloud NAT flow logs provide detailed records of outbound connections and are enabled directly on the Cloud NAT gateway itself. Option B is correct because configuring a log sink to export Cloud NAT logs to BigQuery is a valid step to audit outbound connections, but the primary step to enable logging is to update the existing Cloud NAT gateway to enable flow logs (Option E). Together, these two steps (B and E) allow you to capture and analyze outbound traffic for auditing.

Answer

Enable private Google access on the subnet

Answer

Enable VPC Flow Logs on the subnet

Answer

Create a new Cloud NAT gateway with logging enabled

Question 9

A company wants to migrate a MySQL database running on-premises to Cloud SQL with minimal downtime. Which GCP service should they use?

Accepted Answer

Database Migration Service. Database Migration Service (DMS) supports homogeneous migrations for MySQL, PostgreSQL, and SQL Server with minimal downtime using continuous replication. Migrate for Compute Engine is for VM migration, Transfer Appliance for bulk data, and Storage Transfer Service for object storage.

Answer

Migrate for Compute Engine

Answer

Storage Transfer Service

Answer

Transfer Appliance

Question 10

An organization uses Cloud Storage to store critical documents. They want to protect against accidental deletion or overwriting of objects. Which feature should they enable?

Accepted Answer

Object versioning and retention policies. Object versioning and retention policies together protect against accidental deletion and overwrites. Versioning keeps multiple versions of objects, and retention policies prevent deletion until a specified time. Uniform bucket-level access is for access control, not protection. Object lifecycle management automates transitions/deletion, not protection. Encryption protects data at rest.

Answer

Uniform bucket-level access

Answer

Object lifecycle management rules

Answer

Customer-managed encryption keys (CMEK)

Question 11

A data scientist needs read-only access to a Cloud Storage bucket containing training data. What is the least privileged IAM role to grant at the bucket level?

Accepted Answer

roles/storage.objectViewer. Roles/storage.objectViewer grants read-only access to objects in a Cloud Storage bucket without allowing any write or administrative actions. This is the least privileged role that satisfies the requirement for read-only access to training data at the bucket level, as it only permits storage.objects.get and storage.objects.list permissions.

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectCreator

Answer

roles/storage.admin

Question 12

Refer to the exhibit. A load balancer forwards HTTPS traffic to a target pool with two instances. The health check is configured on port 80 with path /health. Some users report intermittent connection errors. What is the most likely cause?

Accepted Answer

The health check is using HTTP but the backend instances only serve HTTPS, causing them to be marked unhealthy.. The health check is configured to use HTTP on port 80, but the backend instances only serve HTTPS. When the load balancer sends an HTTP GET request to /health on port 80, the instances either reject the connection or fail to respond correctly, causing the health check to fail. This marks the instances as unhealthy, leading to intermittent connection errors as traffic is not forwarded to them.

Answer

The health check path /health does not exist on the backend instances.

Answer

The load balancer's IP address is not reachable from the internet.

Answer

The instances are in different zones, causing latency.

Question 13

A company has a Cloud SQL for PostgreSQL instance that is experiencing high latency. They suspect a connection pooling issue. Which TWO configurations should be checked? (Choose two.)

Accepted Answer

Cloud SQL Auth Proxy configuration. The Cloud SQL Auth Proxy is a common source of connection pooling issues because it can become a bottleneck if not configured with enough connections or if its connection limit is reached. It acts as a local intermediary, and if it exhausts its available connections, it will queue or drop new requests, causing high latency. Checking its configuration (e.g., the `--max-connections` flag or the number of proxy instances) is essential to diagnose pooling problems.

Answer

Private IP assignment

Answer

Database query insights

Answer

Database version

Question 14

A company wants to run a stateful workload on GKE that requires persistent storage with low latency and high IOPS. They need to use the fastest available storage and are willing to lose data if the pod is rescheduled. Which THREE options should they consider? (Choose 3.)

Accepted Answer

Local SSDs (ephemeral storage). Local SSDs provide the highest IOPS and lowest latency but are ephemeral. Persistent Disk SSD offers high IOPS and low latency while being persistent. Persistent Disk Balanced also provides good performance and durability, though not as high as SSD. All three are among the fastest available storage options in GKE and should be considered for the workload, with the choice depending on the tolerance for data loss and performance needs.

Answer

Memorystore for Redis

Answer

Cloud Storage FUSE

Question 15

A company needs to ensure that only approved machine images can be used to create Compute Engine instances to meet security compliance. Which two methods should they use? (Choose two.)

Accepted Answer

Use a custom role with permissions restricted to specific image families. A custom IAM role can be created with permissions restricted to specific image families (e.g., `compute.images.list` and `compute.instances.create` with conditions), ensuring that only approved image families can be used to launch instances. This directly enforces compliance by preventing the use of unapproved images at the IAM level.

Answer

Use VPC Service Controls to prevent creation from unauthorized images

Answer

Use Cloud Asset Inventory to detect non-compliant images and trigger remediation

Answer

Use IAM conditions on compute.instances.create to require a specific family label