Google PCA Practice Test 43 — 15 Questions

Question 1

A data engineer needs to analyze data in BigQuery but must mask personally identifiable information (PII) based on user roles. Which service should they use?

Accepted Answer

BigQuery column-level security. BigQuery column-level security allows you to apply fine-grained access controls to specific columns containing PII, such as by using policy tags to restrict access based on user roles. This directly meets the requirement to mask sensitive data in BigQuery without moving or duplicating data, as it integrates with Cloud IAM to enforce role-based access at query time.

Answer

Cloud Key Management Service

Answer

Cloud Data Catalog

Answer

Cloud Data Loss Prevention (DLP)

Question 2

Refer to the exhibit. The process-image function fails intermittently with a memory limit exceeded error. Which action will MOST effectively resolve the issue?

Accepted Answer

Increase the function memory to 256MB.. The error 'memory limit exceeded' indicates the function is running out of allocated memory. Increasing the function memory to 256MB directly addresses this by providing more memory for execution. In Google Cloud Functions, memory is also tied to CPU allocation, so increasing memory can improve performance and prevent out-of-memory errors.

Answer

Increase the function timeout to 120 seconds.

Answer

Reduce the maximum concurrent executions to 5.

Answer

Change the trigger to Cloud Pub/Sub to reduce load.

Question 3

Refer to the exhibit. A user creates a snapshot of a persistent disk. Later, they want to create a new VM from this snapshot in the same project but in a different region (europe-west1). Which step is missing or incorrect?

Accepted Answer

The user must wait for the snapshot operation to complete before using it to create a VM.. A snapshot operation is asynchronous; the snapshot must reach the 'READY' state before it can be used to create a VM. Attempting to create a VM from a snapshot that is still being created will fail, as the snapshot data is not yet fully available.

Answer

The snapshot cannot be used to create a VM in a different region; the user must first create a disk in the same region and then replicate it.

Answer

The snapshot must be created with '--storage-location=europe-west1' to be usable in that region.

Answer

The user must specify the '--region' flag when creating the snapshot to make it available in europe-west1.

Question 4

When creating a Compute Engine instance from a custom image stored in another project, which gcloud flag is required?

Accepted Answer

--image-project. When creating a Compute Engine instance from a custom image stored in another project, the `--image-project` flag is required to specify the project that contains the image. Without this flag, gcloud defaults to the current project and will not find the image. The `--image` flag is also required to specify the image name, but the question specifically highlights the cross-project situation, making `--image-project` the distinctive required flag.

Answer

--source-instance

Answer

--image

Answer

--image-family

Question 5

A company needs to connect two VPC networks in different Google Cloud regions. The VPCs are in separate projects under the same organization. The connection must use private IP addresses and support high throughput. Which TWO options meet these requirements? (Choose 2.)

Accepted Answer

VPC Network Peering. VPC Network Peering allows direct private IP connectivity between two VPCs in different projects and regions, using RFC 1918 addresses without internet gateways or VPNs. It supports high throughput because traffic stays within Google's network backbone and does not rely on encrypted tunnels that can introduce overhead.

Answer

HA VPN Gateway

Answer

Cloud NAT

Answer

Shared VPC

Question 6

A financial services company is migrating a sensitive customer data application to Google Cloud. The application runs on Compute Engine VMs in a VPC. The security team requires that all data at rest in Cloud Storage and BigQuery must be encrypted with customer-managed encryption keys (CMEK). Additionally, the keys must be stored in a different project than the data, and access to the keys must be audited. The operations team has set up a CMEK key in Cloud KMS in a separate project, assigned the Cloud KMS CryptoKey Encrypter/Decrypter role to the data project's Compute Engine service account, and enabled Cloud Storage and BigQuery to use CMEK. However, when the application tries to read from Cloud Storage, it fails with 'Access Denied.' The Cloud KMS key is in project 'kms-proj' and the data is in project 'data-proj'. What is the most likely cause?

Accepted Answer

The Cloud Storage service agent in 'data-proj' does not have the Cloud KMS CryptoKey Encrypter/Decrypter role.. Cloud Storage uses a Google-managed service agent (not the Compute Engine service account) to interact with CMEK keys. When Cloud Storage is configured to use CMEK, its service agent in the data project must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the key in the KMS project. Without this permission, Cloud Storage cannot decrypt the key to access the data, resulting in an 'Access Denied' error even though the VM's service account has the correct role.

Answer

The Compute Engine service account used by the VM does not have the Cloud KMS Decrypter role.

Answer

The VPC firewall rules are blocking egress to Cloud KMS.

Answer

The Cloud KMS key has been disabled due to an Organization Policy.

Question 7

A financial services company is designing a multi-region disaster recovery architecture for a critical application. The application runs on Compute Engine with a stateful backend using Cloud Spanner. The Recovery Time Objective (RTO) is 1 hour, and the Recovery Point Objective (RPO) is 15 minutes. What architecture meets these requirements cost-effectively?

Accepted Answer

Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.. It uses Cloud Spanner's multi-region configuration, which provides synchronous replication across regions with automatic failover, meeting an RPO of 15 minutes (typically seconds) and an RTO of 1 hour. Active-active traffic load balancing with Compute Engine ensures that the application can immediately route traffic to the healthy region, minimizing downtime without the need for manual failover or backup/restore operations.

Answer

Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.

Answer

Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.

Answer

Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.

Question 8

A company runs a web application on GKE and wants to expose it to the internet using a global HTTP(S) load balancer with Cloud CDN. Which TWO GCP resources are required to configure this setup? (Choose TWO.)

Accepted Answer

Kubernetes Ingress resource with a GCE ingress controller. A is correct because a Kubernetes Ingress resource with a GCE ingress controller is required to integrate a GKE application with a global HTTP(S) load balancer. The GCE ingress controller provisions a Google Cloud HTTP(S) load balancer and configures the necessary forwarding rules, URL maps, and backend services to route external traffic to the appropriate Kubernetes Services. This setup is essential for enabling Cloud CDN, which caches content at Google's global edge points.

Answer

Cloud NAT gateway

Answer

A Kubernetes Service of type LoadBalancer

Answer

Cloud VPN tunnel

Question 9

Given the IAM policy:

```json
{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:alice@example.com"],
      "condition": {
        "expression": "resource.name.startsWith('projects/_/buckets/bucket-x/objects/')",
        "title": "Restrict to bucket-x"
      }
    }
  ]
}
```
What does the condition in this IAM policy do?

Accepted Answer

It allows Alice to view objects only in bucket-x.. The condition in the IAM policy restricts the `storage.objects.get` action to the `projects/_/buckets/bucket-x/objects/*` resource, which means Alice can only view (read) objects within that specific bucket. The `storage.objects.list` action is also allowed on `bucket-x`, enabling her to list its contents. No other actions or buckets are permitted, making option B correct.

Answer

It denies Alice access to all buckets.

Answer

It allows Alice to view objects in any bucket.

Answer

It allows Alice to list all buckets in the project.

Answer

It allows Alice to view and delete objects in bucket-x.

Question 10

Which Google Cloud service provides a fully managed, serverless data warehouse for petabyte-scale analytics using SQL?

Accepted Answer

BigQuery. BigQuery is Google Cloud's fully managed, serverless data warehouse designed for petabyte-scale analytics using standard SQL. It automatically handles infrastructure scaling, partitioning, and query optimization, allowing users to run fast SQL queries on massive datasets without managing servers or clusters.

Answer

Firestore

Answer

Cloud Spanner

Answer

Cloud SQL

Question 11

A company wants to implement an event-driven architecture where uploads to a Cloud Storage bucket trigger processing in a serverless function. The function must process each object within a few seconds and handle bursts of thousands of uploads. Which service should they use?

Accepted Answer

Cloud Functions. Cloud Functions is the correct choice because it is a fully managed, event-driven serverless compute service that natively triggers on Cloud Storage bucket events (e.g., object finalize/create). It automatically scales from zero to thousands of concurrent invocations within seconds, meeting the burst requirement, and has a maximum timeout of 9 minutes (well above the 'few seconds' requirement).

Answer

Google Kubernetes Engine

Answer

Cloud Run for Anthos

Answer

Compute Engine with autoscaling

Question 12

A security engineer wants to configure Identity-Aware Proxy (IAP) for an HTTPS load-balanced application to enforce zero-trust access. Users will authenticate with their Google accounts. What is the minimum set of IAM roles needed for a user to access the application behind IAP?

Accepted Answer

roles/iap.httpsResourceAccessor. To access an application protected by IAP over HTTPS, a user must have the IAP-secured Web App User role (roles/iap.httpsResourceAccessor) on the resource. This role grants permission to access the resource through IAP. The other roles are not sufficient: roles/iam.serviceAccountUser is for managing service accounts, roles/iap.tunnelResourceAccessor is for TCP forwarding, and roles/compute.viewer only allows viewing Compute Engine resources, not accessing the application.

Answer

roles/iam.serviceAccountUser

Answer

roles/iap.tunnelResourceAccessor

Answer

roles/compute.viewer

Question 13

A team wants to automatically move data from Cloud Storage Standard class to Nearline class after 30 days, and to Archive class after 365 days. Which GCP feature should be used?

Accepted Answer

Cloud Storage lifecycle management policies. Cloud Storage lifecycle management policies allow you to define rules for automatic transitions between storage classes based on object age. Option A refers to the specific `gsutil lifecycle set` command used to apply these policies, but the feature itself is called lifecycle management policies (option D). Cloud Storage Transfer Service is for moving data between buckets or from external sources, not for lifecycle transitions. Google Cloud Armor is a security service, unrelated to storage class transitions.

Answer

Cloud Storage Object Lifecycle Management (via gsutil lifecycle set)

Answer

Cloud Storage Transfer Service

Answer

Google Cloud Armor

Question 14

An application running on Compute Engine is experiencing increased latency. You suspect a network bottleneck due to high egress traffic. Which gcloud command can you use to quickly check the network egress traffic for a specific VM instance?

Accepted Answer

gcloud logging read 'resource.type=gce_instance AND jsonPayload.egress_bytes'. The gcloud logging read command allows you to query Cloud Logging for specific log entries. For a Compute Engine instance, the resource type is gce_instance. You can filter for egress bytes by using the query 'resource.type=gce_instance AND jsonPayload.egress_bytes'. This will return log entries containing egress bytes information, assuming your VM is configured to send these logs (e.g., via the monitoring agent or VPC flow logs). This is the quickest way among the given options to check network egress traffic for a specific VM using a native gcloud command.

Option B is incorrect: gcloud compute instances list only displays the network IP of instances, not egress traffic metrics.
Option C is incorrect: gcloud compute instances get-serial-port-output shows the serial console output, which does not include network traffic data.
Option D is incorrect: gcloud monitoring metrics list just lists available metrics but does not retrieve the actual traffic data for a specific instance. To get the data you would need to use gcloud monitoring metric descriptors or gcloud monitoring dashboards, but the command as given does not return traffic.

Thus, A is the best choice.

Answer

gcloud compute instances list --format='value(networkInterfaces[0].networkIP)'

Answer

gcloud compute instances get-serial-port-output

Answer

gcloud monitoring metrics list

Question 15

A company is building a microservices architecture on Google Kubernetes Engine (GKE) and needs to ensure each microservice can only access specific Cloud Storage buckets. IAM permissions should be assigned at the pod level, not at the node level. What is the recommended approach?

Accepted Answer

Use Workload Identity to bind a Kubernetes service account to a GCP service account. Workload Identity is the recommended approach because it allows you to bind a Kubernetes service account (KSA) to a Google Cloud service account (GSA), enabling pods to authenticate to Google Cloud APIs without managing or storing service account keys. This satisfies the requirement for pod-level IAM permissions, as each pod can inherit the GSA's roles (e.g., roles/storage.objectViewer) for specific Cloud Storage buckets, while avoiding node-level assignment.

Answer

Store service account keys in Kubernetes secrets and mount them into each pod

Answer

Use a CSI driver to mount IAM credentials into pods

Answer

Assign a service account to each node pool and configure pod security policies