Google PCA Practice Test 49 — 15 Questions

Question 1

A company runs a critical application on Compute Engine and wants to automate recovery in case of a zone failure by redeploying instances in another zone. They have a startup script that configures the application. What is the simplest way to achieve zone failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a regional managed instance group (MIG) with autohealing. An instance group with autohealing and a health check can automatically recreate instances in another zone if the instance becomes unhealthy. However, for zone-level failure, a regional managed instance group (MIG) distributes instances across multiple zones and automatically rebalances if one zone fails.

Answer

Use a global load balancer with a backend service pointing to multiple zonal instance groups

Answer

Set up a Cloud Scheduler to check instance health and create new instances via Cloud Functions

Answer

Create a snapshot schedule and use Cloud Deployment Manager to recreate instances

Question 2

To achieve a 99.999% availability SLA for a globally distributed application using Cloud Spanner, which configuration is required?

Accepted Answer

Multi-region instance configuration. Cloud Spanner multi-region configuration provides 99.999% SLA. Single-region offers 99.99%. Fine-grained access control and customer-managed encryption keys (CMEK) do not affect availability SLA.

Answer

Fine-grained access control

Answer

Single-region instance configuration

Answer

Customer-managed encryption keys (CMEK)

Question 3

You need to set up monitoring and alerting for a critical service that must maintain an error rate below 0.1%. You want to be notified if the error rate exceeds this threshold over a 5-minute window. Which THREE components should you configure?

Accepted Answer

Service Level Indicator (SLI) based on error rate. A service-level objective (SLO) defines the target (99.9% error-free). A service-level indicator (SLI) measures the actual error rate. An alerting policy triggers when the SLO is breached. Notification channels send alerts. Log-based alerts are for log content, not metrics. The correct combination: SLO, SLI, alerting policy with notification channels.

Answer

Log-based alert with filter for all errors

Answer

Cloud Audit Logs sink to BigQuery

Question 4

Refer to the exhibit. A developer is trying to connect to the Kubernetes API server from their workstation using the master IP (34.67.89.12) but receives a timeout. The developer can reach other external IPs. What is the most likely reason for the timeout?

Accepted Answer

The private cluster is configured with a private endpoint and public endpoint disabled, so the master IP is not accessible from outside the VPC.. A private GKE cluster with a private endpoint and public endpoint disabled means the Kubernetes API server is only reachable from within the cluster's VPC network. The developer's workstation is outside the VPC, so attempts to reach the master IP (34.67.89.12) will time out, even though other external IPs are reachable. This is a common configuration for security-sensitive workloads that require the API server to be isolated from the public internet.

Answer

The cluster is in a different region than the developer's VPC.

Answer

The developer's workstation does not have the required firewall rule to allow traffic to the master IP.

Answer

The Kubernetes Engine API is not enabled in the developer's project.

Question 5

An organization needs to connect their on-premises network to Google Cloud with a 99.99% SLA and up to 10 Gbps throughput. They have a supported partner for network connectivity. Which solution meets these requirements?

Accepted Answer

HA VPN with two Cloud VPN gateways and four tunnels. HA VPN offers a 99.99% SLA and supports up to 10 Gbps throughput. It requires two VPN gateways and four tunnels for redundancy. Dedicated Interconnect offers 10-100 Gbps but a 99.99% SLA only with two connections. Partner Interconnect provides up to 10 Gbps but the SLA depends on the partner. The question specifies up to 10 Gbps and a partner, but HA VPN is the only one with a built-in 99.99% SLA for a single connection. However, the 'supported partner' clue suggests Partner Interconnect, but its SLA is not 99.99% guaranteed by Google. The correct answer is HA VPN because it explicitly offers 99.99% SLA and can handle up to 10 Gbps.

Answer

Partner Interconnect with multiple VLAN attachments

Answer

Dedicated Interconnect with a single 10 Gbps connection

Answer

Classic VPN with a single tunnel

Question 6

An e-commerce platform uses Cloud Spanner in a multi-region configuration. They want to achieve the highest possible availability SLA. Which deployment configuration should they choose?

Question 7

An engineer needs to list all Compute Engine instances in a project using the command line. Which gcloud command should they use?

Accepted Answer

gcloud compute instances list. The correct command to list Compute Engine instances is 'gcloud compute instances list'. The other options are incorrect: 'gcloud compute machine-types list' lists machine types, 'gcloud compute instance-groups list' lists instance groups, and 'gcloud compute instances describe' describes a specific instance.

Answer

gcloud compute instances describe

Answer

gcloud compute instance-groups list

Answer

gcloud compute machine-types list

Question 8

A company is planning a phased migration of their on-premises database to Cloud SQL. They want to minimize downtime and ensure data consistency. Which approach should they use?

Accepted Answer

Use Database Migration Service (DMS). Database Migration Service (DMS) supports continuous replication with minimal downtime. Export and import involves downtime. Lift-and-shift is not a GCP service. VM migration is for servers, not databases.

Answer

Lift and shift the database server to Compute Engine

Answer

Export the database to a SQL dump file and import into Cloud SQL

Answer

Use VM migration to move the database server

Question 9

A company uses Cloud SQL for PostgreSQL and needs to recover a database to a specific point in time within the last week, down to the second. Which feature should they enable?

Question 10

A company wants to test the performance of a new web application under high load. They need a tool that can generate traffic from multiple regions. Which Google Cloud service should they use?

Accepted Answer

Cloud Load Testing. Cloud Load Testing (formerly Cloud Load Balancing) is a managed service that can generate load from multiple regions. Locust is an open-source tool that can be deployed on Compute Engine but is not a managed GCP service. Cloud Shell is a development environment. Cloud Run is for running containers.

Answer

Cloud Run

Answer

Cloud Shell

Answer

Locust

Question 11

A company uses Cloud SQL for MySQL for its transactional database. They need to ensure automatic failover in case of a zonal outage with minimal data loss. What configuration should they use?

Question 12

An organization needs to ensure that only Compute Engine instances with a specific label can access a Cloud Storage bucket. Which policy type should be used?

Accepted Answer

IAM policy. IAM policies are the correct mechanism to control access to Cloud Storage buckets based on identity and conditions. By attaching an IAM policy to the bucket with a condition that checks for a specific label on the requesting Compute Engine instance (e.g., using `resource.labels.tag`), you can restrict access to only those instances that have that label. This is the native Google Cloud way to implement attribute-based access control (ABAC) for storage resources.

Answer

Organization policy

Answer

Firewall rule

Answer

Signed URL

Question 13

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization? (Choose all that apply.)

Accepted Answer

service-account@project-id.iam.gserviceaccount.com. The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts IAM role grants to members from specified domains. The correct answer includes both A and D. Option A: service-account@project-id.iam.gserviceaccount.com is allowed because service accounts ending in 'gserviceaccount.com' are Google-managed and implicitly exempt from the constraint. Option D: user@example.com is allowed because 'example.com' is one of the domains specified in the constraint (as implied by the correct marking). The constraint explicitly lists allowed domains, and 'example.com' is included. Options B and C are from domains not in the allowed list, so they cannot be granted roles.

Answer

external@otherdomain.com

Answer

admin@another-customer-domain.com

Question 14

A company runs a global e-commerce site on GKE. They want to ensure disaster recovery with multi-region deployment. What is the best practice for configuring GKE clusters?

Accepted Answer

Deploy separate regional clusters in two or more regions.. For disaster recovery with a multi-region deployment, the best practice is to deploy separate regional clusters in two or more regions. This ensures that if an entire region fails, traffic can be redirected to the other region's cluster, providing true geographic redundancy. A single cluster, whether zonal or regional, cannot survive a regional outage because it is bound to a single control plane location.

Answer

Use a single zonal cluster with node auto-repair.

Answer

Deploy a single cluster with multi-master setup.

Answer

Use a single regional cluster with multiple zones.

Question 15

You want to create a log-based alert in Cloud Logging that triggers when a specific error message appears in application logs. What is the first step?

Accepted Answer

Create a logs-based metric that filters for the error message. To create a log-based alert, you first define a logs-based metric that counts occurrences of the error pattern. Then you create an alerting policy that monitors this metric and triggers when the count exceeds a threshold. Notifications are configured in the alerting policy, not the metric.

Answer

Configure a Pub/Sub notification channel for alerts

Answer

Create a log sink to export logs to Cloud Storage

Answer

Set up an alerting policy directly on the log entries without a metric