Google PCA Practice Test 46 — 15 Questions

Question 1

A startup is setting up a CI/CD pipeline for their web application using Cloud Build and Cloud Deploy. They have configured a Cloud Build trigger that executes on pushes to the main branch of a Cloud Source Repositories repository. The trigger runs a build step that builds a Docker image and pushes it to Artifact Registry, then creates a release using Cloud Deploy. The pipeline fails with an error message indicating that the Cloud Build service account does not have permission to create releases. What should the architect do to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the Cloud Deploy Developer IAM role to the Cloud Build service account.. The Cloud Build service account (typically the Compute Engine default service account or a custom service account) needs the Cloud Deploy Developer IAM role (roles/clouddeploy.developer) to create releases in Cloud Deploy. This role grants the necessary permissions, such as clouddeploy.releases.create, which are required for the Cloud Build trigger to successfully create a release after building and pushing the Docker image. Without this role, the pipeline fails with a permission error, making option A the correct resolution.

Answer

Verify that the cloudbuild.yaml file contains the correct steps.

Answer

Enable the Cloud Deploy API for the project.

Answer

Grant the Cloud Build service account the Cloud Run Admin role.

Question 2

Your company runs a multi-region Cloud Spanner instance for a global financial application. The SLA requirement is 99.999% availability. You need to ensure that the database remains available during a regional outage. What configuration should you use?

Accepted Answer

Use a multi-region configuration (e.g., nam3) with automatic replication across multiple regions.. Cloud Spanner multi-region configurations (e.g., nam3, eur3) automatically replicate data across regions within a continent. They provide 99.999% availability SLA. A single-region configuration offers 99.99% SLA. Read replicas (as in Cloud SQL) are not a concept in Spanner. Multi-region configs use multiple read-write regions.

Answer

Use a dual-region configuration with two regions but only one for writes.

Answer

Use a single-region configuration with a read replica in another region.

Answer

Configure a single-region instance and create periodic backups to restore in another region.

Question 3

A gaming company needs to store player session data that is frequently updated and requires strong consistency within a single region. The data model is simple key-value with few attributes. They expect up to 1 million concurrent players, each performing 10 writes per second. Which database is most suitable?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is a fully managed, high-throughput, low-latency NoSQL wide-column store designed for massive-scale workloads with simple key-value access patterns. It scales linearly to handle millions of operations per second and provides strong consistency for single-row reads/writes within a region, matching the gaming session use case. Its row-key design supports the 10 writes/sec per player at 1M concurrent players without the relational overhead of Cloud SQL.

Answer

Cloud SQL

Answer

Firestore

Answer

Memorystore

Question 4

A company wants to allow users to authenticate to a web application running on Compute Engine using their existing corporate Active Directory credentials without exposing the application to the public internet. Which approach should they use?

Accepted Answer

Set up Identity-Aware Proxy (IAP) and sync Active Directory to Cloud Identity. Identity-Aware Proxy (IAP) provides zero-trust access control to applications without exposing them to the public internet, and it integrates with Cloud Identity. By syncing on-premises Active Directory to Cloud Identity (via GCDS or federation), users can authenticate with their corporate credentials through IAP, which enforces IAM policies before allowing access to the Compute Engine-hosted app.

Answer

Configure a Cloud VPN and allow only corporate IP addresses in firewall rules

Answer

Use Cloud Load Balancing with SSL and client certificates

Answer

Configure Cloud NAT and assign static IPs to users

Question 5

A media streaming company wants to serve video content globally with low latency. They plan to cache static objects (thumbnails, manifest files) at edge locations, while dynamic API requests are handled by a backend in a single region. Which combination should they use?

Accepted Answer

Cloud CDN with an external HTTP(S) load balancer. Cloud CDN integrates with an external HTTP(S) load balancer to cache static content at Google edge locations while forwarding dynamic API requests to the backend in a single region. The external HTTP(S) load balancer provides a global anycast IP, terminates client connections at the edge, and routes requests to the backend based on URL maps. This combination is the standard Google Cloud architecture for global content delivery with low latency for static assets and centralized dynamic processing.

Answer

Cloud CDN with an internal TCP/UDP load balancer

Answer

Cloud Armor with a TCP/SSL proxy load balancer

Answer

VPC peering with Cloud NAT

Question 6

Which GCP service can be used to detect and redact sensitive data such as credit card numbers in text files stored in Cloud Storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is a fully managed service designed to discover, classify, and protect sensitive data. It uses built-in infoType detectors (e.g., CREDIT_CARD_NUMBER, US_SOCIAL_SECURITY_NUMBER) to scan text files in Cloud Storage and can redact or mask the findings. The other services do not provide data inspection and redaction capabilities.

Answer

Security Command Center

Answer

Cloud Key Management Service

Answer

Cloud Audit Logs

Question 7

A media company stores large video files that are accessed infrequently (once a quarter) and must be retained for 10 years for compliance. They want to minimize storage cost. Which Cloud Storage class should they use?

Accepted Answer

Archive storage class. Archive storage is the lowest-cost class for data accessed less than once a year. It is ideal for long-term archival with 10-year retention. Standard is for frequent access, Nearline for 30 days, Coldline for 90 days. Archive is the cheapest for infrequent access.

Answer

Standard storage class

Answer

Coldline storage class

Answer

Nearline storage class

Question 8

A company wants to migrate an on-premises MySQL database to GCP with minimal downtime and support for automated failover in case of a zone outage. Which GCP service should they use?

Accepted Answer

Cloud SQL for MySQL. Cloud SQL for MySQL is the managed relational database service on GCP that supports MySQL, offers high availability with automatic failover across zones, and enables minimal-downtime migration via Database Migration Service (DMS) or replication-based approaches. It directly matches the requirement of migrating an existing MySQL workload while preserving engine compatibility. The other options either use a different engine (PostgreSQL), a NoSQL wide-column store (Bigtable), or a document database (Firestore), none of which support MySQL workloads.

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Bigtable

Answer

Firestore

Question 9

A company stores large amounts of data in Cloud Storage and wants to reduce costs. Which two actions should they take? (Choose two.)

Accepted Answer

Enable object versioning and configure lifecycle rules to delete noncurrent versions after 90 days.. Option B is correct because enabling object versioning while adding a lifecycle rule to delete noncurrent versions after 90 days prevents old object versions from accumulating indefinitely, which directly reduces storage costs from versioned data. Option D is correct because lifecycle management can automatically transition objects to colder storage classes such as Nearline or Coldline after 30 days, and these classes have lower storage pricing than Standard for infrequently accessed data. Option A is not appropriate because disabling object versioning removes data protection and recovery capability rather than being a cost-optimization best practice. Option C does not reduce costs; bucket labels only improve cost tracking and reporting by department. Option E would likely increase costs because Standard is the most expensive default storage class for long-term or infrequently accessed data.

Answer

Disable object versioning to prevent multiple versions.

Answer

Add bucket labels to track cost by department.

Answer

Change the default storage class to Standard for all buckets.

Question 10

A large enterprise is migrating their on-premises data center to Google Cloud. They have hundreds of VMs and need to minimize network latency between on-prem and cloud during migration. They have high bandwidth requirements. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, high-bandwidth, low-latency connection between on-premises data centers and Google Cloud, bypassing the public internet. This is ideal for large-scale migrations with hundreds of VMs where minimizing latency and ensuring consistent throughput is critical.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Peering with Google

Question 11

A company is migrating an on-premises Oracle database to Google Cloud. They want to minimize application changes and need a fully managed, PostgreSQL-compatible database with high performance for OLTP workloads. Which service is MOST suitable?

Accepted Answer

AlloyDB. AlloyDB for PostgreSQL is Google Cloud's fully managed, PostgreSQL-compatible database engine purpose-built for high-performance OLTP, offering up to 4x faster transactional throughput than standard PostgreSQL and a columnar engine for analytics. Because it is wire-compatible with PostgreSQL, applications using standard drivers and SQL need minimal changes, satisfying the migration goal. Its managed nature offloads backups, replication, and patching, which fits the 'fully managed' requirement.

Answer

Bigtable

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Spanner

Question 12

Your company runs a production application on Compute Engine instances behind a managed instance group (MIG). You need to perform a rolling update with canary testing, gradually shifting traffic to the new version only if performance metrics are healthy. Which approach should you use?

Accepted Answer

Use Cloud Deploy with a deployment strategy that includes a canary phase and automated verification. Cloud Deploy is Google Cloud's managed continuous delivery service that natively supports progressive rollout strategies including canary deployments with automated verification against SLOs or custom metrics. It integrates with Cloud Monitoring to pause or roll back a rollout if health checks fail, which directly satisfies the requirement of gradually shifting traffic only when performance metrics are healthy. This is the intended Google-recommended pattern for canary releases on GCE MIGs.

Answer

Create a new MIG with the new template and use a Cloud Load Balancer's traffic splitting

Answer

Manually update each instance by SSH'ing and running a script

Answer

Use gcloud compute instance-groups managed rolling-action start-update with a maxSurge of 0

Question 13

A company wants to deploy a web application behind an HTTPS Load Balancer and only allow authenticated users from their corporate Active Directory. Which two services should they use together? (Choose two.)

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) [CORRECT] is the right choice because it enforces authentication and authorization at the application layer for HTTPS Load Balancer backends, verifying user identity before any request reaches the web application. Cloud Identity [CORRECT] is also correct because it can federate with the corporate Active Directory (via SAML or secure LDAP), providing the identity source that IAP uses to authenticate and authorize corporate users. Together, IAP and Cloud Identity let the company restrict access to authenticated AD users without exposing the app publicly. VPC Service Controls is incorrect because it guards GCP API/service perimeters rather than end-user web application authentication. Cloud NAT is incorrect because it provides outbound internet access for private instances, not user authentication. Cloud Armor is incorrect because it provides WAF/DDoS protection and IP-based rules, not identity-based authentication against Active Directory.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud Armor

Question 14

Which Google Cloud service provides a fully managed, auto-scaling environment for running stateless HTTP(S) web applications using a variety of supported programming languages?

Accepted Answer

App Engine Standard. App Engine Standard is the correct choice because it is a fully managed, auto-scaling platform specifically designed for stateless HTTP(S) web applications. It supports multiple programming languages (e.g., Python, Java, Go, PHP, Node.js) and automatically handles scaling, load balancing, and patching, allowing developers to focus on code without managing infrastructure.

Answer

Cloud Functions

Answer

Google Kubernetes Engine

Answer

Compute Engine

Question 15

A DevOps team uses Cloud Build to deploy Docker images to GKE. They want to ensure that only images that have passed a vulnerability scan and been signed by a trusted authority can be deployed. Which service should they integrate with Cloud Build and GKE?

Accepted Answer

Binary Authorization. Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed to GKE. It integrates with Cloud Build to sign images after vulnerability scanning and with GKE to enforce policies that only allow signed images. This directly meets the requirement of ensuring only scanned and signed images are deployed.

Answer

Artifact Analysis

Answer

Cloud Security Scanner

Answer

Cloud Key Management Service