Google PCA Practice Test 44 — 15 Questions

Question 1

After executing the command, a security review reveals that the service account sa-bucket-reader can also list buckets in the project, which was not intended. What is the most likely cause?

Accepted Answer

The service account has a project-level role that includes storage.list.. The service account sa-bucket-reader was able to list buckets in the project, which requires the storage.buckets.list permission. This permission is included in several predefined project-level roles, such as roles/storage.objectViewer or roles/storage.legacyBucketReader. If the service account was granted a project-level role that includes storage.buckets.list, it would have the unintended ability to list all buckets in the project, even if bucket-level IAM was configured to restrict access to specific buckets.

Answer

The etag was incorrect, causing a concurrent modification.

Answer

The policy update failed due to a missing condition.

Answer

The service account also has bucket-level IAM roles.

Question 2

A company wants to implement blameless postmortems as part of their SRE practices. Which THREE principles should they follow?

Accepted Answer

Create actionable recommendations to prevent recurrence. Option B is correct because blameless postmortems must produce concrete, actionable recommendations and follow-up items that reduce the likelihood or impact of recurrence, rather than stopping at description. Option C is correct because the core of blameless postmortems is analyzing systemic and contributing causes of the incident without attributing fault to individuals, which encourages honest reporting. Option E is correct because findings, timelines, and lessons learned should be documented and shared with relevant stakeholders so the whole organization benefits and improves. Option A is incorrect because limiting participation to senior management excludes the engineers and responders who hold the technical details and undermines learning. Option D is incorrect because assigning responsibility to the team that caused the incident is blame-oriented and contradicts the blameless principle.

Answer

Only involve senior management in the review

Answer

Assign responsibility to the team that caused the incident

Question 3

A company is migrating a legacy application that uses a file server to GCP. The application requires a shared file system that supports the NFS protocol and can be mounted by multiple Compute Engine instances. The team also needs to use Cloud NAT to allow the instances to download updates. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud NAT. Cloud Filestore (D) is correct because it is GCP's fully managed file storage service that natively supports the NFSv3 protocol and can be mounted simultaneously by multiple Compute Engine instances, which is exactly what the legacy application requires for its shared file system. Cloud NAT (A) is correct because it provides outbound internet access for instances without external IP addresses, allowing them to download updates while remaining unreachable from the internet. Cloud VPN (B) is not appropriate here because it establishes encrypted tunnels to on-premises or other networks, not a shared NFS file system or outbound NAT. Cloud Storage Fuse (C) is not correct because it mounts Cloud Storage buckets as a local file system via a FUSE adapter, which does not provide a true NFS-protocol shared file system for multiple instances. Private Google Access (E) is not correct because it only enables instances without external IPs to reach Google APIs and services, not general internet downloads, which is what Cloud NAT handles.

Answer

Cloud VPN

Answer

Cloud Storage Fuse

Answer

Private Google Access

Question 4

A company wants to implement a CI/CD pipeline for a Java application that will be deployed to Cloud Run. They use Cloud Build and Artifact Registry. The pipeline must compile the Java code, run unit tests, build a container image, and deploy to Cloud Run. Which THREE steps are required in the cloudbuild.yaml? (Choose 3)

Accepted Answer

Step with image 'docker' and args: ['build', '-t', '...']. Option B is correct because building the container image for the Java application requires a Docker build step (e.g., image 'docker' with args ['build', '-t', '...']), which produces the image that will later be pushed to Artifact Registry and deployed to Cloud Run. Option C is correct because compiling the Java code and running unit tests is done with Maven, so a step using the 'maven' image with args ['mvn', 'compile', 'test'] satisfies the compile-and-test requirement of the pipeline. Option E is correct because deploying the built image to Cloud Run requires a gcloud step invoking 'gcloud run deploy' with the appropriate service, image, region, and platform flags. Option A is not needed because 'gcloud container clusters get-credentials' configures kubectl access to a GKE cluster, which is irrelevant when the target is Cloud Run. Option D is not needed because an npm test step applies to Node.js projects, not a Java application built with Maven.

Answer

Step with image 'gcloud' and entrypoint: 'gcloud', args: ['container', 'clusters', 'get-credentials']

Answer

Step with image 'node' and entrypoint: 'npm', args: ['test']

Question 5

Which TWO services can be used to create a CI/CD pipeline for a containerized application on Google Cloud? (Choose 2)

Accepted Answer

Cloud Deploy. Cloud Build (C) is correct because it is Google Cloud's managed CI service that executes build steps defined in a cloudbuild.yaml (or Dockerfile) to build, test, and push container images to Artifact Registry, and it can trigger pipelines from Cloud Source Repositories, GitHub, or Bitbucket. Cloud Deploy (A) is correct because it is Google Cloud's managed continuous delivery service that takes a built container image and progressively rolls it out to GKE, Cloud Run, or Anthos target environments using declarative delivery pipelines and promotion/approval stages. Together they form the CI (Cloud Build) and CD (Cloud Deploy) halves of a containerized CI/CD pipeline. Cloud Functions (B) is a serverless event-driven compute service for running code snippets, not a pipeline orchestrator. Cloud Scheduler (D) is a cron-based job scheduler that can trigger jobs but does not build or deploy containers. Cloud Run (E) is a serverless container runtime that hosts the application, not a service for constructing the CI/CD pipeline itself.

Answer

Cloud Functions

Answer

Cloud Scheduler

Answer

Cloud Run

Question 6

You are designing a multi-region deployment for a critical application on GKE. The application must withstand a regional outage and automatically redirect traffic to the healthy region. Which THREE components must be configured? (Choose 3)

Accepted Answer

Cloud Spanner. Option A (Cloud Spanner) is correct because it is a globally distributed, strongly consistent, multi-region database with automatic synchronous replication and 99.999% SLA, which lets the application survive a full regional outage without data loss or manual failover. Option B (Global HTTP(S) Load Balancer) is correct because it provides a single global anycast IP, health-check-based backend selection, and automatic traffic redirection to the healthy region when a regional backend fails. Option D (Multi-cluster Ingress) is correct because it is the GKE feature that registers multiple regional GKE clusters as backends of a Global HTTP(S) Load Balancer and performs cross-region failover based on cluster health. Option C (Regional Cloud SQL) is not appropriate because a regional instance is confined to one region and cannot serve traffic after that region fails. Option E (Cloud NAT) is not relevant because it only provides outbound internet access for private GKE nodes and does not contribute to cross-region failover or traffic redirection.

Answer

Regional Cloud SQL

Answer

Cloud NAT

Question 7

A company runs a latency-sensitive web application on Compute Engine in us-east1. They want to improve response times for users in Europe and Asia without changing the application architecture. Which TWO actions should they take? (Choose 2.)

Accepted Answer

Enable Cloud CDN on the load balancer. Option B is correct because enabling Cloud CDN on the load balancer caches static and cacheable content at Google's globally distributed edge points of presence, so users in Europe and Asia are served from nearby edge locations instead of being backhauled to us-east1, reducing latency without any application changes. Option D is correct because a multi-region (global external) load balancer with backends in europe-west1 and asia-east1 places compute capacity close to those user populations, and the global anycast VIP routes each user to the nearest healthy backend, directly cutting round-trip time while preserving the existing architecture. Option A is not appropriate because preemptible VMs only reduce cost and can be terminated at any time, which harms latency-sensitive availability rather than improving response times. Option C does not help because us-west1 is on the US West Coast, which is not closer to European or Asian users than us-east1. Option E is wrong because Cloud Armor is a WAF/DDoS protection service that filters malicious traffic and cannot reduce network latency for legitimate users.

Answer

Use preemptible VMs to reduce cost

Answer

Deploy additional instances in us-west1

Answer

Use Cloud Armor to block high-latency requests

Question 8

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Accepted Answer

Cloud Deploy. Cloud Build (E) is the correct service for the build-and-test stage: it can compile the Java application, run unit tests, build the Docker image, and push it to Artifact Registry as part of a CI pipeline defined in cloudbuild.yaml. Cloud Deploy (D) is the correct service for the delivery/deployment stage: it is a managed continuous delivery service that takes the built image and progressively deploys it to GKE targets (with rollout and approval controls). Together, Cloud Build handles CI and Cloud Deploy handles CD to GKE, matching the requested pipeline. Cloud Functions (A) is for event-driven serverless functions, not container image builds or GKE deployments. Compute Engine (B) provides VMs and is not the managed CI/CD service needed here. Cloud Run (C) runs containerized services serverlessly but does not build images or deploy workloads to GKE.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Cloud Run

Question 9

A security team wants to monitor and audit all changes to IAM policies in a Google Cloud organization. They need to set up real-time alerts when a new binding is added. Which THREE services should they combine to achieve this?

Accepted Answer

Cloud Pub/Sub. Cloud Audit Logs (D) is correct because Admin Activity audit logs automatically record IAM policy changes such as SetIamPolicy events, which capture when a new binding is added, providing the source of truth for auditing and monitoring. Cloud Pub/Sub (B) is correct because a log sink can route those filtered audit log entries to a Pub/Sub topic in real time, decoupling log ingestion from downstream processing. Cloud Functions (C) is correct because a function can be triggered by messages published to that Pub/Sub topic to evaluate the new binding and send real-time alerts. Cloud Scheduler (A) is not needed since it only runs jobs on a time schedule and does not provide event-driven, real-time reaction to IAM changes. Cloud Storage (E) is not needed because it is object storage for retaining or archiving data, not a real-time alerting or event-processing service.

Answer

Cloud Scheduler

Answer

Cloud Storage

Question 10

A company is planning a hybrid cloud architecture using Anthos to manage workloads across on-premises data centers and Google Cloud. They need to select two key components that enable consistent configuration, policy, and security across environments. Which two should they choose?

Accepted Answer

GKE on-prem. GKE on-prem (B) is correct because it extends the Google Kubernetes Engine control plane to on-premises data centers, letting the company run the same Kubernetes-based workload platform in both environments so configuration and security policies can be applied consistently. Config Sync (D) is correct because it continuously reconciles cluster configuration and policy from a central source of truth (typically a Git repository) across both on-prem and Google Cloud clusters, which is exactly what Anthos uses to enforce consistent configuration, policy, and security at scale. Cloud Interconnect (A) only provides private, high-bandwidth network connectivity between on-premises and Google Cloud and does not manage configuration or policy. Cloud Build (C) is a CI/CD service for building and deploying artifacts, not a mechanism for enforcing cross-environment configuration or policy. Cloud Load Balancing (E) distributes traffic to backends and provides no configuration, policy, or security consistency across environments.

Answer

Cloud Interconnect

Answer

Cloud Build

Answer

Cloud Load Balancing

Question 11

What are two best practices for designing a scalable Kubernetes architecture on GKE?

Accepted Answer

Enable horizontal pod autoscaling. Option C is correct because enabling Horizontal Pod Autoscaling (HPA) lets GKE automatically adjust the number of pod replicas based on metrics such as CPU utilization or custom metrics, which is essential for handling variable load in a scalable architecture. Option D is correct because using multiple node pools with different machine types allows you to right-size workloads, isolate resource-intensive or specialized workloads (e.g., GPU, memory-optimized), and scale each pool independently, improving both efficiency and scalability. Option A is incorrect because StatefulSets are designed for stateful applications requiring stable network identities and persistent storage, not stateless workloads, which are better served by Deployments. Option B is incorrect because disabling the Cluster Autoscaler prevents nodes from being added or removed automatically as demand changes, undermining scalability. Option E is incorrect because a single-zone cluster concentrates resources in one zone, reducing availability and limiting the ability to scale resiliently across zones.

Answer

Use StatefulSets for stateless applications

Answer

Disable Cluster Autoscaler

Answer

Use a single zone cluster

Question 12

A company is migrating a legacy monolithic application to Google Cloud. The application runs on a single VM and uses a local MySQL database. The goal is to minimize changes to the application code while improving availability. Which strategy should the company use?

Accepted Answer

Lift and shift the VM to Compute Engine, and migrate the database to Cloud SQL with a failover replica.. It minimizes code changes by lifting the application VM to Compute Engine as-is, while migrating the local MySQL database to Cloud SQL with a failover replica. This improves availability through Cloud SQL's managed automatic failover to a standby replica in a different zone, without requiring application code changes to the database connection logic (the application can continue using the same MySQL protocol).

Answer

Use a managed instance group for the application VM and store the database on a persistent disk attached to the primary instance.

Answer

Re-architect the application into microservices and use Cloud Run for stateless components.

Answer

Containerize the application and deploy on Google Kubernetes Engine (GKE) with Cloud Spanner as the database.

Question 13

Which THREE practices are recommended for organizing projects in a Google Cloud organization?

Accepted Answer

Use a separate project for each environment (e.g., development, staging, production).. Using separate projects for each environment (development, staging, production) enforces resource isolation, prevents accidental cross-environment changes, and allows independent IAM policies, billing, and quotas. This aligns with Google Cloud's recommended resource hierarchy best practices for managing lifecycle and security boundaries.

Answer

Create a separate project to hold organization policies.

Answer

Consolidate all production resources into a single project for simplicity.

Question 14

A company wants to improve the reliability of their microservices architecture on Google Cloud. Which TWO practices should they implement? (Choose 2)

Accepted Answer

Implement retry with exponential backoff. B is correct because implementing retry with exponential backoff allows transient failures (e.g., network timeouts, temporary service unavailability) to be handled gracefully by automatically retrying the request after increasing delays, reducing load on the recovering service. This pattern is essential in microservices on Google Cloud to improve reliability without overwhelming downstream dependencies.

Answer

Design with a single point of failure for simplicity

Answer

Use synchronous communication between all services

Answer

Disable health checks to reduce latency

Question 15

A startup wants to encrypt data at rest in Cloud Storage using Customer-Managed Encryption Keys (CMEK). They have already created a Cloud KMS key ring and key. What additional step is required to enable CMEK for a new Cloud Storage bucket?

Accepted Answer

Grant the Cloud Storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.. To use CMEK with Cloud Storage, the Cloud Storage service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key. This permission allows the bucket's underlying storage system to encrypt and decrypt objects using the customer-managed key. Without this IAM binding, the bucket cannot access the key, and CMEK operations will fail.

Answer

Enable the Cloud KMS API in the project where the bucket will reside.

Answer

Create a Cloud HSM key instead, as CMEK requires HSM.

Answer

Add a label to the key ring to associate it with the bucket.