Google PCA Practice Test 45 — 15 Questions

Question 1

A company runs a critical application on Compute Engine instances. They want to automatically patch the operating system on a weekly schedule to meet compliance requirements. Which Google Cloud service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OS Config. OS Config, part of VM Manager, provides patch management capabilities including scheduled patching and compliance reporting.

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Answer

Cloud Build

Question 2

Refer to the exhibit. A cloud administrator is attempting to grant the BigQuery Data Viewer role to an external user (user@example.com) but receives the error shown. What is the most likely cause?

Accepted Answer

The organization policy constraints/iam.allowedPolicyMemberDomains blocks external domains.. The error indicates that the organization's policy constraints/iam.allowedPolicyMemberDomains is blocking the addition of an external user. This constraint restricts IAM policy bindings to only allow members from specified domains, and since user@example.com is from an external domain, the binding is denied. The error message directly references this constraint, making it the most likely cause.

Answer

The BigQuery dataset requires domain-wide delegation.

Answer

The user does not have the resourcemanager.projects.setIamPolicy permission.

Answer

The external user must first be added to a Google Group.

Question 3

A security team wants to monitor and audit all changes to IAM policies in a Google Cloud organization. They need to set up real-time alerts when a new binding is added. Which THREE services should they combine to achieve this?

Accepted Answer

Cloud Pub/Sub. Cloud Audit Logs record IAM changes. Cloud Pub/Sub can receive logs in near real-time. Cloud Functions can process Pub/Sub messages and trigger alerts (e.g., via email). Cloud Storage is for storage, not real-time alerting. Cloud Scheduler is for cron jobs. Cloud Armor is for security policies at the network edge.

Answer

Cloud Scheduler

Answer

Cloud Storage

Question 4

A company has a legacy monolithic application running on-premises that must be migrated to Google Cloud with minimal changes. The application uses a SQL Server database and has strict licensing constraints. Which migration approach and storage service is most appropriate?

Accepted Answer

Lift-and-shift onto Compute Engine with Cloud SQL for SQL Server. The requirement specifies minimal changes and strict licensing constraints. Lift-and-shift onto Compute Engine with Cloud SQL for SQL Server allows you to migrate the monolithic application with minimal modifications while leveraging a managed SQL Server service that respects existing licensing (including bring-your-own-license). This avoids the cost and complexity of re-architecting or re-platforming.

Answer

Re-architect to microservices on GKE with AlloyDB

Answer

Lift-and-shift onto Compute Engine with SQL Server on the same VM

Answer

Re-platform to Cloud Spanner

Question 5

You are a cloud architect for an e-commerce company. Their application runs on Google Kubernetes Engine (GKE) with a Regional cluster. The application consists of a frontend service, a backend service, and a Redis cache. Traffic is routed via an external HTTP(S) Load Balancer to the frontend. Recently, customers have reported intermittent 502 Bad Gateway errors during peak hours. The frontend logs show 'upstream connect error or disconnect/reset before headers. retried and limit reset' errors. The backend service is deployed with 3 replicas, each with resource requests of 1 CPU and 2 GB memory. The cluster autoscaler is enabled with a minimum of 3 nodes and a maximum of 10 nodes, using e2-standard-4 instances. The backend service's HPA is configured with CPU utilization target of 80%. During peak hours, CPU utilization on the backend pods reaches 90%, but the HPA does not scale up. The cluster has sufficient node capacity. What should you do to resolve the issue?

Accepted Answer

Lower the HPA CPU target to 60% and increase the number of replicas min to 5.. The HPA is configured with a CPU utilization target of 80%, but during peak hours, CPU utilization reaches 90% without triggering scale-up. This indicates that the HPA's target utilization is too high relative to the actual load, causing the HPA to not scale because the average CPU utilization across pods may still be below the target when considering the metric calculation. Lowering the HPA CPU target to 60% ensures that the HPA triggers scaling earlier, and increasing the minimum replicas to 5 provides a baseline capacity to absorb traffic spikes, preventing the upstream connect errors from the backend being overwhelmed.

Answer

Change the HPA to use memory utilization instead of CPU.

Answer

Increase the backend service's max connections per pod in the backendConfig.

Answer

Increase the maximum number of nodes in the cluster autoscaler to 20.

Question 6

Refer to the exhibit. All five nginx pods are scheduled on the same node (default-pool-1). What is the most likely reason?

Accepted Answer

The other nodes have taints that the pods do not tolerate.. Taints on nodes prevent pods from being scheduled unless the pods have corresponding tolerations. If the other nodes have taints that the nginx pods do not tolerate, the scheduler will only place them on nodes without those taints, which in this case is default-pool-1. This is a common scenario when nodes are dedicated to specific workloads or have special hardware.

Answer

The node auto-scaler has not created additional nodes yet, but the other nodes are present.

Answer

The pods have a nodeSelector that matches only default-pool-1.

Answer

The resource requests are too high, so the scheduler packed pods onto one node due to resource constraints on the others.

Question 7

A global e-commerce platform uses Cloud Spanner in a multi-region configuration across us-central1 (leader) and europe-west1. The application writes all orders to a single table and reads from both regions. During a flash sale, write latency spikes, causing order failures. The team notices that the leader region's CPU utilization is at 95%, while the europe-west1 region is mostly idle. The application uses partitioned DML for batch updates. The development team proposes increasing node count. What should the architect do to reduce write latency while maintaining global read performance?

Accepted Answer

Change the placement configuration to use a dual-region with multiple writable leaders.. Configuring a dual-region with multiple writable leaders distributes write operations across both regions, reducing CPU utilization on the original leader region. This approach improves write latency during high-traffic events like a flash sale while maintaining global read performance from both regions. Scaling by adding nodes (as proposed) is also valid, but among the given choices, changing the placement configuration directly addresses the single-leader bottleneck.

Answer

Implement manual sharding by splitting the large table into multiple smaller tables across instances.

Answer

Use interleaved tables to reduce query latency for reads.

Answer

Create a new node pool with a machine type that has at least 16 vCPUs to handle the write-intensive workload.

Question 8

A user reports that an application running on instance-1 is unreliable and often restarts. What is the most likely cause?

Accepted Answer

The instance is preemptible and can be terminated at any time.. Preemptible instances (now called 'spot instances' in Google Cloud) can be terminated by Google Compute Engine at any time due to resource demands, with only 30 seconds of warning. This makes them unsuitable for applications that require reliability and continuous uptime, as the instance can be stopped abruptly, causing the application to restart or become unavailable.

Answer

The instance is in a single zone without redundancy.

Answer

The machine type is too small.

Answer

The instance is using an outdated image.

Question 9

A financial services firm runs batch risk calculations nightly using a large Compute Engine VM with a GPU. Jobs complete in 4 hours but are not time-sensitive. To reduce costs without sacrificing reliability, the firm enables preemptible VMs but finds that jobs are interrupted and restarting from scratch causes delays. What is the best approach to improve reliability while maintaining cost savings?

Accepted Answer

Use a managed instance group with preemptible VMs and implement checkpointing to save progress periodically.. Using managed instance groups with preemptible VMs and checkpointing allows the job to resume from the last checkpoint after preemption, maintaining reliability. Simply accepting preemptions or using non-preemptible VMs would not balance cost and reliability.

Answer

Request a committed use discount for the GPU and use a standard VM without preemptible.

Answer

Use a non-preemptible VM but downgrade the GPU type to reduce cost.

Answer

Use a spot VM with a high availability SLA, relying on low preemption rates.

Question 10

A multinational e-commerce company needs a globally distributed database that provides strong consistency and transactional support for order processing. Which Google Cloud database service should they use?

Accepted Answer

Cloud Spanner. Cloud Spanner is the correct choice because it is a globally distributed, horizontally scalable relational database service that provides strong consistency and full ACID transactional support across regions. Unlike other Google Cloud databases, Spanner uses synchronous replication and the TrueTime API to guarantee external consistency, making it ideal for order processing systems that require both global scale and transactional integrity.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 11

A security engineer needs to restrict access to a Google Cloud project so that only a specific set of IP addresses can reach Cloud Storage buckets. Which feature should be configured?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define perimeters that restrict access based on context, including IP addresses via access levels.

Answer

IAM Conditions

Answer

Firewall Rules

Answer

Cloud Armor

Question 12

A company is running a critical application on Compute Engine. The application writes logs to a local persistent disk. The operations team wants to ensure logs are not lost if the VM fails. What should they do?

Accepted Answer

Configure the application to write logs to Cloud Logging using the Logging agent.. Cloud Logging with the Logging agent provides a centralized, durable, and managed log storage solution. The agent streams logs from the VM to Cloud Logging in near real-time, ensuring logs are preserved even if the VM or its local persistent disk fails. This decouples log storage from the VM's lifecycle, meeting the operations team's requirement for log durability.

Answer

Use a regional persistent disk to replicate data across zones.

Answer

Schedule persistent disk snapshots every 5 minutes.

Answer

Create a script to copy logs to a Cloud Storage bucket every minute.

Question 13

You need to monitor the performance of a production Cloud Run service and set an alert when the p99 latency exceeds 500 ms over a 5-minute window. Which combination of Cloud Monitoring resources should you use?

Accepted Answer

Define an alerting policy using the metric 'run.googleapis.com/request_latencies' with a percentile aggregator and threshold condition. To alert on latency, you create a custom metric or use an existing metric (e.g., request latencies), then define a threshold condition using an alerting policy. The alerting policy specifies the metric (request latency), aggregator (p99), condition (threshold >500ms for 5 minutes), and notification channel.

Answer

Create a log-based metric for latency and an alerting policy with a condition on the count of logs

Answer

Use Cloud Logging to export logs to BigQuery and run a scheduled query to check latency

Answer

Create an uptime check and set an alert on the check response time

Question 14

A financial services company runs a multi-tier application on Compute Engine. They need to restrict network access so that only the web tier can communicate with the application tier, and only the application tier can access the database tier. All VMs are in the same VPC network. What is the most secure way to implement this?

Accepted Answer

Use VPC firewall rules with target tags to allow traffic between specific tiers.. VPC firewall rules with target tags allow you to precisely control ingress and egress traffic between VM instances based on their assigned tags. By tagging web tier VMs with a tag like 'web-tier' and application tier VMs with 'app-tier', you can create a firewall rule that allows traffic from 'web-tier' to 'app-tier' on the required port (e.g., TCP 8080) and another rule allowing traffic from 'app-tier' to 'db-tier' on the database port (e.g., TCP 3306). This approach enforces the principle of least privilege within a single VPC network without introducing unnecessary complexity or breaking network isolation.

Answer

Use Identity-Aware Proxy (IAP) to manage network access between tiers.

Answer

Create separate VPC networks for each tier and use VPC peering.

Answer

Assign a unique service account to each tier and use IAM conditions to restrict traffic.

Question 15

A security engineer needs to allow a Compute Engine instance with the service account 'sa-prod@project.iam.gserviceaccount.com' to connect to a Cloud SQL instance over a private IP. The VPC has no firewall rules allowing this traffic. What is the MOST secure way to grant access?

Accepted Answer

Add a firewall rule with source service account 'sa-prod@project.iam.gserviceaccount.com' and target service account 'cloud-sql-sa@project.iam.gserviceaccount.com'. Firewall rules can target service accounts directly, allowing fine-grained access without relying on network tags. This avoids managing tags and reduces attack surface.

Answer

Grant the IAM role 'cloudsql.client' to the service account 'sa-prod@project.iam.gserviceaccount.com'

Answer

Add a firewall rule with source tag 'prod' and target tag 'cloud-sql'

Answer

Create a VPC peering connection between the Compute Engine VPC and the Cloud SQL VPC