Google PCA Practice Test 43 — 15 Questions

Question 1

A developer is writing a Cloud Function that processes files uploaded to a Cloud Storage bucket. Which trigger should they use?

Accepted Answer

Cloud Storage trigger. To process files uploaded to a Cloud Storage bucket, the developer should use a Cloud Storage trigger. This trigger type is specifically designed to invoke a Cloud Function in response to events in a Cloud Storage bucket, such as object creation, deletion, or metadata updates.

Answer

HTTP trigger

Answer

Firestore trigger

Answer

Pub/Sub trigger

Question 2

Your company runs a multi-tier web application on Google Kubernetes Engine (GKE). The application consists of a frontend service, a backend API service, and a PostgreSQL database deployed using a StatefulSet with persistent volumes. The backend service exposes a gRPC endpoint. Recently, the team noticed that the backend service experiences intermittent high latency and occasional timeouts. The frontend service is stateless and scales well. The backend service is CPU-bound. The database is not the bottleneck. The cluster has three nodes of type n1-standard-4. The backend service is deployed with 10 replicas, each requesting 1 CPU and 2 Gi memory. Node utilization is around 70% CPU. The team suspects the network is the issue. However, after reviewing the GKE monitoring dashboard, they see that the network bytes sent/received per second for the backend pods is well below the node's network bandwidth limit. The latency spikes seem correlated with periods of high CPU throttling on the backend pods. The backend service's gRPC requests are small (under 1 KB), and the responses are also small. The team has already optimized the application code. What should the team do to reduce latency?

Accepted Answer

Increase the CPU request for the backend pods to 2 CPUs.. The latency spikes correlate with CPU throttling, and increasing the CPU request to 2 CPUs ensures that each backend pod receives a guaranteed CPU share, reducing throttling under load. Since the backend is CPU-bound and node utilization is 70%, the current 1 CPU request may be insufficient, causing the Kubernetes CPU manager to throttle the pods when the node's CPU is contended. This directly addresses the root cause without adding unnecessary replicas or memory.

Answer

Increase the number of nodes in the cluster to reduce network contention.

Answer

Increase the number of backend replicas to 20.

Answer

Increase the memory request for the backend pods to 4 Gi.

Question 3

Which THREE factors should be considered when choosing a Google Cloud region for deploying a low-latency application serving global users? (Choose three.)

Accepted Answer

Proximity to your user base to minimize network latency.. Option A is correct because placing the region close to the user base reduces round-trip network latency, which is the primary driver of perceived responsiveness for a low-latency application serving global users. Option B is correct because not every Google Cloud service or machine type is available in every region, so you must confirm the required services (for example, specific compute SKUs or managed services) exist in the chosen region before deploying. Option D is correct because data residency and privacy regulations such as GDPR or CCPA can legally require that user data be stored and processed within specific jurisdictions, directly constraining which regions are permissible. Option C is not among the marked answers because, while regional pricing differences exist, cost optimization is secondary to latency, service availability, and legal compliance when the explicit goal is low-latency global service. Option E is not among the marked answers because the number of zones affects fault tolerance and high availability rather than the latency experienced by global users, and zone count is not the deciding factor for region selection in this scenario.

Answer

Pricing differences between regions due to variations in compute and storage costs.

Answer

Number of zones in the region to ensure high availability.

Question 4

An organization wants to monitor network traffic between VMs in a VPC for troubleshooting. Which TWO services can provide this?

Accepted Answer

Packet Mirroring (Network Intelligence Center). Packet Mirroring (Network Intelligence Center) (B) is correct because it captures full packet payloads from specified VM instances in a VPC and forwards them to a collector instance for deep troubleshooting and analysis of traffic between VMs. VPC Flow Logs (C) is correct because it records IP flow information (5-tuple, bytes, packets, timestamps) for traffic to and from VM instances, subnets, and VPCs, providing visibility into network traffic patterns for troubleshooting. Cloud Audit Logs (A) only records administrative and data-access API activity, not network traffic between VMs. Cloud Monitoring (D) collects metrics and uptime checks but does not capture network flow or packet-level traffic data. Cloud Logging (E) stores and queries log entries but is not itself a network traffic capture service.

Answer

Cloud Audit Logs

Answer

Cloud Monitoring

Answer

Cloud Logging

Question 5

A financial services company runs a multi-tier application on Compute Engine. They need to restrict network access so that only the web tier can communicate with the application tier, and only the application tier can access the database tier. All VMs are in the same VPC network. What is the most secure way to implement this?

Accepted Answer

Use VPC firewall rules with target tags to allow traffic between specific tiers.. VPC firewall rules with target tags allow you to precisely control ingress and egress traffic between VM instances based on their assigned tags. By tagging web tier VMs with a tag like 'web-tier' and application tier VMs with 'app-tier', you can create a firewall rule that allows traffic from 'web-tier' to 'app-tier' on the required port (e.g., TCP 8080) and another rule allowing traffic from 'app-tier' to 'db-tier' on the database port (e.g., TCP 3306). This approach enforces the principle of least privilege within a single VPC network without introducing unnecessary complexity or breaking network isolation.

Answer

Use Identity-Aware Proxy (IAP) to manage network access between tiers.

Answer

Create separate VPC networks for each tier and use VPC peering.

Answer

Assign a unique service account to each tier and use IAM conditions to restrict traffic.

Question 6

A company runs a batch processing workload on Compute Engine instances in a managed instance group (MIG). The job is CPU-intensive and takes approximately 4 hours to complete. The company wants to reduce costs without sacrificing performance. Which action should they take?

Accepted Answer

Use preemptible VMs for the MIG and implement a checkpointing mechanism to handle interruptions.. Preemptible VMs are significantly cheaper than standard VMs but can be terminated at any time. For a batch processing workload that is CPU-intensive and runs for 4 hours, using preemptible VMs in a MIG with a checkpointing mechanism allows the job to resume from the last saved state after an interruption, thus reducing costs without sacrificing performance.

Answer

Purchase committed use discounts for the instance type.

Answer

Change the machine series to a smaller machine type.

Answer

Provision additional reserved VMs to ensure capacity.

Question 7

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) are signed and approved via an attestation authority. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization is the Google Cloud service that enforces deploy-time security controls on GKE by allowing only container images that are signed and attested by trusted authorities. It integrates with GKE admission controllers to block unsigned or unattested images. This directly matches the requirement to enforce signed and approved images via an attestation authority.

Answer

Container Registry

Answer

Cloud Armor

Answer

Cloud Security Scanner

Question 8

A developer needs to deploy a stateful application that requires persistent storage across pod restarts in Google Kubernetes Engine. Which resource should they use?

Accepted Answer

PersistentVolumeClaim. A PersistentVolumeClaim (PVC) is the correct resource because it allows a pod to request persistent storage that survives pod restarts. In GKE, a PVC binds to a PersistentVolume (PV), which can be backed by Compute Engine persistent disks, ensuring data remains available even if the pod is rescheduled or restarted.

Answer

ConfigMap

Answer

EmptyDir

Answer

Secret

Question 9

When creating a Compute Engine instance from a custom image stored in another project, which gcloud flag is required?

Accepted Answer

--image-project. When creating a Compute Engine instance from a custom image stored in another project, the `--image-project` flag is required to specify the project that contains the image. Without this flag, gcloud defaults to the current project and will not find the image. The `--image` flag is also required to specify the image name, but the question specifically highlights the cross-project situation, making `--image-project` the distinctive required flag.

Answer

--source-instance

Answer

--image

Answer

--image-family

Question 10

A company is using BigQuery for analytics and wants to optimize query costs. They have many ad-hoc queries that scan large tables. What is the best practice?

Accepted Answer

Use clustering and partitioning on tables.. Clustering and partitioning reduce the amount of data scanned by BigQuery for each query, directly lowering query costs (which are based on bytes processed). Partitioning allows queries to skip entire partitions based on a date or timestamp column, while clustering sorts data within partitions, enabling block-level pruning for filter predicates. This is the most effective and scalable way to optimize ad-hoc queries on large tables without changing the query logic.

Answer

Use flat-rate pricing.

Answer

Use BI Engine.

Answer

Use materialized views.

Question 11

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. Recently, they experienced a targeted attack that bypassed Cloud Armor's predefined rules. The attack involved a high rate of legitimate-looking requests from a small set of IPs that made the application unresponsive. The team needs to block the attack quickly without affecting legitimate users. What should they do?

Accepted Answer

Enable Google Cloud Armor Adaptive Protection.. Cloud Armor Adaptive Protection uses machine learning to analyze traffic patterns and automatically create tailored rules to block application-layer DDoS attacks that bypass predefined rules. In this scenario, the attack consists of legitimate-looking requests from a small set of IPs, which Adaptive Protection can detect as anomalous and generate a custom signature to block without manual intervention, preserving access for legitimate users.

Answer

Increase the load balancer's capacity to absorb the attack.

Answer

Configure rate limiting with a threshold based on the normal traffic pattern.

Answer

Add the attacking IPs to a Cloud Armor deny list.

Question 12

A Cloud Spanner instance is experiencing high latency for point reads. The instance has 5 nodes and the read throughput is moderate. The table has a primary key with monotonically increasing values. What is the most likely cause and optimization?

Accepted Answer

The primary key design causes hotspotting; use a hash prefix or add a leading random value.. The monotonically increasing primary key causes all writes to be directed to the last tablet (splitting point), creating a hotspot on one node. This hotspot leads to high latency for point reads because that node becomes a bottleneck. Adding a hash prefix or a leading random value distributes writes and reads evenly across all nodes, resolving the hotspotting issue.

Answer

Use interleaved tables to reduce the number of index lookups.

Answer

The instance is underprovisioned; add more nodes.

Answer

The instance has too many nodes causing transaction conflicts; reduce nodes.

Question 13

A financial services company is designing a multi-region application on Google Kubernetes Engine (GKE) for high availability. They need to serve user requests from the closest region and automatically failover if a region becomes unavailable. Which architecture should they use?

Accepted Answer

Deploy GKE clusters in multiple regions and use a multicluster ingress with an external HTTP(S) load balancer set up with the global external backend.. Deploying GKE clusters in multiple regions and using a multicluster ingress with a global external HTTP(S) load balancer enables traffic routing to the closest healthy backend cluster based on latency or geography, and automatically fails over to another region if one becomes unavailable. The global external backend configuration allows the load balancer to distribute traffic across multiple regional GKE clusters, providing both proximity-based routing and high availability.

Answer

Use a global external HTTP(S) load balancer with a single backend service pointing to one regional cluster.

Answer

Use Cloud CDN in front of a single regional GKE cluster to cache content.

Answer

Use a single regional GKE cluster with auto-scaling across zones.

Question 14

Your service has a 99.99% uptime SLO (monthly error budget ~ 4 minutes). Which TWO monitoring practices best support this SLO? (Choose 2)

Accepted Answer

Use a combination of availability (e.g., HTTP 200 rate) and latency (e.g., p99) as SLIs.. Option B is correct because a 99.99% uptime SLO is best measured with SLIs that reflect user-perceived health, so combining an availability SLI (the proportion of successful HTTP 200 responses) with a latency SLI (such as p99 request duration) captures both whether requests succeed and whether they are served acceptably fast. Option E is correct because with a monthly error budget of roughly 4 minutes, tracking error budget consumption and alerting on a burn rate threshold (for example, a fast-burn alert at 14.4x over 1 hour or a slow-burn alert at 6x over 6 hours) detects when the budget is being exhausted too quickly and enables timely action. Option A is not correct because CPU utilization is a resource metric, not a direct SLI for an uptime SLO, and an 80% average threshold does not reliably indicate user-visible failures. Option C is not correct because relying only on synthetic monitoring from multiple locations omits real user traffic and can miss failures that affect actual customers. Option D is not correct because alerting on every 5xx error immediately is too noisy and does not account for error budget policy or burn rate.

Answer

Monitor CPU utilization and alert when average exceeds 80%.

Answer

Use only synthetic monitoring from multiple locations.

Answer

Alert on every 5xx error immediately.

Question 15

A company is designing a disaster recovery (DR) plan for their Cloud SQL for PostgreSQL instance. They need to recover the database to a specific point in time within the last 7 days, with a Recovery Point Objective (RPO) of less than 1 hour. Which feature should they use?

Accepted Answer

Point-in-time recovery (PITR). Point-in-time recovery (PITR) for Cloud SQL for PostgreSQL lets you restore an instance to any specific timestamp within a configurable retention window (up to 7 days), using write-ahead log (WAL) archiving combined with automated backups. This directly satisfies the requirement to recover to a specific point in time within the last 7 days with an RPO under 1 hour, because WAL segments are continuously shipped and enable granular recovery. Automated backups alone only allow restore to the backup's snapshot time, which would not meet a sub-hour RPO.

Answer

Exporting the database daily to Cloud Storage

Answer

Failover replica

Answer

Automated backups only