Google PCA Practice Test 44 — 15 Questions

Question 1

Your company has a production Cloud SQL for PostgreSQL instance in us-central1 with automated backups enabled. You need to ensure that if the zone fails, the database automatically fails over to a standby in a different zone with minimal downtime. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the instance as a highly available (regional) instance.. Cloud SQL high availability (HA) configuration creates a standby instance in a different zone. The primary and standby use synchronous replication, and automatic failover occurs if the primary zone fails. Enabling deletion protection does not provide HA. Read replicas are for read scaling, not automatic failover. Automated backups alone do not provide failover.

Answer

Enable deletion protection on the instance.

Answer

Create a cross-region read replica and manually promote it during a failure.

Answer

Enable point-in-time recovery (PITR) and keep 30 days of transaction logs.

Question 2

A financial services company uses VPC Service Controls to protect their project containing BigQuery datasets and Cloud Storage buckets. They have a perimeter that includes the BigQuery service. Users report that they cannot export data from BigQuery to Cloud Storage using the web console. The export job fails with an access denied error. The team needs to allow exports while maintaining data exfiltration prevention. The users have the necessary IAM permissions (BigQuery Data Editor, Storage Object Admin) on the appropriate resources. What should the architect do?

Accepted Answer

Add Cloud Storage to the same VPC Service Controls perimeter.. VPC Service Controls perimeters enforce data exfiltration prevention by default, blocking egress from protected services (like BigQuery) to unprotected services (like Cloud Storage). Adding Cloud Storage to the same perimeter allows BigQuery to export data to Cloud Storage while still preventing data from leaving the perimeter. The users already have the necessary IAM roles (BigQuery Data Editor and Storage Object Admin), so the issue is solely the perimeter boundary, not permissions.

Answer

Remove BigQuery from the VPC Service Controls perimeter.

Answer

Create an access level that permits exports during business hours.

Answer

Grant the users the Storage Object Admin role at the bucket level.

Question 3

An administrator is configuring firewall rules in a VPC. Two rules apply to the same traffic: rule 1 allows ingress from 0.0.0.0/0 on TCP 80, rule 2 denies ingress from 10.0.0.0/8 on TCP 80. Rule 1 has priority 1000, rule 2 has priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because rule 2 has higher priority.. In Google Cloud VPC firewall rules, rules are evaluated in priority order, with lower numbers having higher priority. Rule 2 (priority 500) is evaluated before rule 1 (priority 1000), and since rule 2 explicitly denies ingress from 10.0.0.0/8 on TCP 80, traffic from 10.0.0.1 is denied. Google Cloud firewall rules are stateful, and the first matching rule determines the outcome; there is no implicit override between allow and deny.

Answer

The result is unpredictable without knowing the rule creation order.

Answer

Traffic is allowed because allow rules override deny rules.

Answer

Traffic is allowed because rule 1 has a lower priority number.

Question 4

A company runs a global SaaS application on Google Cloud using Cloud Spanner. They need to ensure disaster recovery with a Recovery Time Objective (RTO) of less than 5 seconds and a Recovery Point Objective (RPO) of zero. Which configuration should they use?

Accepted Answer

Deploy Cloud Spanner in a multi-region configuration. Cloud Spanner supports multi-region configurations with synchronous replication across regions, providing automatic failover with RPO of zero (no data loss) and RTO of less than 5 seconds. Backups can take hours to restore. Read replicas are for scaling reads, not for disaster recovery. Point-in-time recovery is for restoring to a specific time, not for automatic failover.

Answer

Enable point-in-time recovery (PITR)

Answer

Use read replicas in another region

Answer

Configure automated backups with a 1-hour backup frequency

Question 5

A company runs a batch processing workload that can tolerate interruptions. The job runs for 4 hours every night and can be restarted from checkpoints. They want to minimize compute costs. Which Compute Engine machine configuration is MOST cost-effective?

Accepted Answer

Preemptible VMs. Preemptible VMs are up to 80% cheaper than standard VMs and can be terminated at any time, but the workload is checkpointable and runs overnight, so interruptions are manageable. Committed use discounts require a 1-year or 3-year commitment and are not ideal for short daily jobs. Standard VMs are more expensive.

Answer

Standard VMs with sustained use discounts

Answer

Spot VMs with a specific reservation

Answer

Committed use VMs (1-year commitment)

Question 6

A developer needs to cache session state for a web application to reduce latency. The cache must be highly available and support sub-millisecond access times. Which Google Cloud service should they use?

Accepted Answer

Memorystore for Redis. Memorystore for Redis provides a managed in-memory cache with sub-millisecond latency and supports high availability with replication.

Answer

Firestore

Answer

Cloud Storage

Answer

Bigtable

Question 7

A company wants to migrate its on-premises monolithic application to Google Cloud with minimal changes. They plan to run it on a virtual machine with a predictable workload that runs 24/7 for a one-year commitment. Which compute option is MOST cost-effective?

Accepted Answer

Committed use discounts. Committed use discounts provide significant cost savings for predictable, always-on workloads over a 1-year (or 3-year) term. While preemptible VMs are cheaper, they can be terminated at any time, making them unsuitable for a 24/7 workload. On-demand VMs are more expensive than committed use. Spot VMs are similar to preemptible but still not guaranteed.

Answer

Spot VMs

Answer

On-demand VMs

Answer

Preemptible VMs

Question 8

A startup wants to deploy a containerised web application that auto-scales based on HTTP request traffic, with no infrastructure management. They expect unpredictable traffic spikes. Which compute service is most suitable?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that automatically scales to zero and can handle traffic spikes. It abstracts away infrastructure management. GKE requires cluster management even in Autopilot (though reduced). Compute Engine requires manual scaling. Cloud Functions is for event-driven functions, not containerised web apps.

Answer

Compute Engine with managed instance groups

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Autopilot

Question 9

A company wants to migrate its on-premises Oracle database to GCP with minimal changes. They require a fully managed, PostgreSQL-compatible database that offers high performance for analytics and AI workloads. Which service should they choose?

Accepted Answer

AlloyDB. AlloyDB is a fully managed PostgreSQL-compatible database optimized for high performance analytics and AI, with support for vector embeddings and other AI features.

Answer

Cloud Spanner

Answer

BigQuery

Answer

Cloud SQL for PostgreSQL

Question 10

A startup wants to run a containerized web application that scales to zero when not in use and charges only for request processing time. Which compute service is most appropriate?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales down to zero and charges per request, making it ideal for variable workloads that need to minimize cost when idle.

Answer

Google Kubernetes Engine (Autopilot)

Answer

Compute Engine with preemptible VMs

Answer

App Engine Standard

Question 11

An organization wants to establish a dedicated, low-latency connection between their on-premises data center and GCP with a guaranteed SLA of 99.99% uptime. They anticipate high bandwidth usage but want to avoid per-GB egress charges. Which connectivity option should they choose?

Accepted Answer

Dedicated Cloud Interconnect. Dedicated Cloud Interconnect provides a direct physical connection with SLA up to 99.99%, high bandwidth, and no egress charges, ideal for high-volume hybrid workloads.

Answer

Partner Cloud Interconnect

Answer

Cloud VPN with HA VPN gateway

Answer

Classic VPN

Question 12

A company is migrating an on-premises monolithic Java application to Google Cloud. They want to minimize changes to the code while gaining some cloud benefits like autoscaling and managed infrastructure. They plan to eventually refactor to microservices. Which compute option BEST fits their current needs?

Accepted Answer

Deploy the application on App Engine Flexible Environment.. App Engine Flexible Environment supports Java with minimal code changes, provides autoscaling and managed infrastructure, and is suitable for monolithic apps. It allows gradual refactoring to microservices. GKE and Cloud Run require containerization, and Compute Engine needs manual scaling.

Answer

Migrate the application to Cloud Run.

Answer

Deploy the application in a container on GKE Standard.

Answer

Migrate the application to Compute Engine VMs.

Question 13

Which THREE factors should be considered when choosing a Google Cloud region for deploying a low-latency application serving global users? (Choose three.)

Accepted Answer

Proximity to your user base to minimize network latency.. Deploying in a Google Cloud region geographically close to your user base minimizes network latency, which is critical for low-latency applications. Google Cloud's global network uses edge points of presence (PoPs) and premium tier routing to reduce round-trip time (RTT), but the physical distance between the region and users still directly impacts latency due to the speed of light and fiber optic propagation delays.

Answer

Pricing differences between regions due to variations in compute and storage costs.

Answer

Number of zones in the region to ensure high availability.

Question 14

An organization has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They launched a Compute Engine instance in subnet-a with an internal IP 10.0.1.2 and a public IP. They want the instance to only allow HTTPS traffic from the internet. Which firewall rule should they create?

Accepted Answer

Ingress rule: allow tcp:443, source 0.0.0.0/0, target tag 'https-server'. The instance needs to accept incoming HTTPS traffic (TCP port 443) from the internet. An ingress firewall rule with source 0.0.0.0/0 allows traffic from any external IP, and applying it to instances with the target tag 'https-server' ensures only tagged instances are affected. This matches the requirement to allow only HTTPS from the internet.

Answer

Ingress rule: allow tcp:0-65535, source 0.0.0.0/0, target tag 'https-server'

Answer

Egress rule: allow tcp:443, destination 0.0.0.0/0, target tag 'https-server'

Answer

Ingress rule: allow tcp:443, source 10.0.0.0/16, target tag 'https-server'

Question 15

Which GCP service should be used to automatically scale a GKE cluster's number of nodes based on pending pods?

Accepted Answer

Cluster Autoscaler. The cluster autoscaler adjusts the number of nodes in node pools based on pod resource requests. HPA scales pods, not nodes. VPA adjusts pod resource requests. Node auto-provisioning is part of cluster autoscaler but the described functionality is cluster autoscaler.

Answer

Vertical Pod Autoscaler (VPA)

Answer

Node Auto-Provisioning

Answer

Horizontal Pod Autoscaler (HPA)