Google PCA Practice Test 5 — 10 Questions

Question 1

You are configuring a Cloud Monitoring alerting policy to notify your SRE team when the error rate of a service exceeds 5% over a 5-minute window. Which type of metric evaluation should you use?

Accepted Answer

Window-based. A window-based metric evaluation (e.g., rate, ratio, or count over a sliding window) is appropriate for error rate over a 5-minute window. Request-based is for latency SLOs.

Answer

Log-based

Answer

Request-based

Answer

Health check-based

Question 2

A company is migrating its on-premises data center to Google Cloud. They need a dedicated, low-latency, high-bandwidth connection between their on-premises network and VPC. They anticipate consistent traffic above 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection with bandwidth up to 100 Gbps per circuit, ideal for high-throughput, low-latency requirements. Partner Interconnect relies on a service provider and typically offers lower bandwidth. HA VPN is over the public internet and may not meet high bandwidth or low latency. Classic VPN is a single tunnel without high availability.

Answer

Partner Interconnect

Answer

HA VPN

Answer

Classic VPN

Question 3

Your company runs a critical application on Google Kubernetes Engine (GKE) in us-central1. The application consists of a frontend deployment with 3 replicas and a backend statefulset with 5 replicas using persistent volumes (SSD). Recently, the team noticed that during a regional outage in us-central1, the application became completely unavailable. They want to design a multi-region architecture that can survive a regional failure with RPO of 1 hour and RTO of 30 minutes. The application is stateless on the frontend but the backend stores critical data on persistent disks. The backend can operate in a read-only mode from a secondary region if needed. They have a limited budget and want to minimize ongoing costs. Which approach should they take?

Accepted Answer

Deploy the frontend and backend in a regional GKE cluster across us-central1, and use a CronJob to take snapshots of persistent volumes every hour and copy them to a secondary region. In disaster, restore the snapshots to a new cluster in the secondary region.. Meets the RPO of 1 hour by using a CronJob to take hourly snapshots of PersistentVolume data and copy them to a secondary region. In a disaster, you restore those snapshots to a new GKE cluster in the secondary region, achieving an RTO of 30 minutes by automating the restore process. This approach minimizes ongoing costs because snapshots are incremental and you only pay for storage in the secondary region when needed, while the frontend remains stateless and can be redeployed quickly.

Answer

Migrate the backend to Cloud SQL for MySQL with cross-region replication, and keep the frontend on GKE with multi-region ingress.

Answer

Deploy the frontend and backend in a regional GKE cluster and use regional persistent disks for the statefulset, replicating data synchronously across zones.

Answer

Deploy the frontend and backend in a single zonal cluster in us-central1-a, and use scheduled snapshots of persistent disks to a different region.

Question 4

A data analytics company runs nightly batch jobs using Compute Engine instances. The jobs can tolerate interruptions, and the company wants to minimize costs. What should they do?

Accepted Answer

Use preemptible VMs for the batch jobs.. Preemptible VMs (now called Spot VMs) are Compute Engine instances that last up to 24 hours and can be terminated at any time by Google Cloud. Because the batch jobs are interruptible, using preemptible VMs reduces compute costs by up to 60-91% compared to standard on-demand VMs, directly meeting the goal of minimizing costs.

Answer

Use C2 high-CPU machine types for faster processing.

Answer

Use standard (on-demand) VMs and commit to a 1-year resource-based commitment.

Answer

Deploy VMs on Sole-tenant nodes for cost isolation.

Question 5

A team is designing a disaster recovery (DR) plan for a critical application. Which THREE components are essential for a robust DR plan? (Choose 3)

Accepted Answer

Failover procedures and runbooks. Failover procedures and runbooks (A) are essential because they provide step-by-step instructions for executing a controlled transition to the secondary site, ensuring minimal downtime and consistent recovery actions. Without documented runbooks, teams risk misconfigurations during a disaster, which can extend recovery time objectives (RTO) beyond acceptable limits.

Answer

A single-region deployment for consistency

Answer

Load testing to validate performance

Question 6

A user wants to store a database password that will be used by a Compute Engine instance. What is the most secure and manageable approach?

Accepted Answer

Use Secret Manager and grant the instance's service account access to the secret. Secret Manager is the most secure and manageable approach because it provides encrypted storage, automatic rotation, and fine-grained access control via IAM. By granting the Compute Engine instance's service account access to the secret, the password is never exposed in plaintext metadata, logs, or disk files, and access can be audited and revoked independently of the instance lifecycle.

Answer

Set the password as an environment variable in instance metadata

Answer

Store the password in Cloud Storage bucket metadata

Answer

Store the password in a file on the instance's boot disk

Question 7

A security administrator wants to ensure that a Cloud Storage bucket named `gs://my-bucket` is only accessible by service accounts, not user accounts. Which action should they take?

Accepted Answer

Create a new IAM policy that removes all user members and adds a service account member with `roles/storage.objectAdmin`.. The requirement is to ensure that only service accounts, not user accounts, can access the bucket. By creating a new IAM policy that removes all user members and adds only a service account member with `roles/storage.objectAdmin`, the administrator directly enforces that no user account (Google Account or Google Workspace user) has any IAM role on the bucket. This is the simplest and most effective way to restrict access exclusively to service accounts.

Answer

Remove the user from the `roles/storage.objectViewer` binding and add a condition to deny user access.

Answer

Add a bucket IAM condition that requires `resource.name.startsWith("projects/_/buckets/my-bucket/objects/")`

Answer

Use a VPC Service Controls perimeter to block user access.

Question 8

A company wants to implement a disaster recovery strategy for a critical application running on Compute Engine with state stored on persistent disks. They need an RTO of less than 15 minutes and an RPO of less than 1 hour. Which TWO steps should they take? (Choose two.)

Accepted Answer

Use regional persistent disks for the application data. Regional persistent disks replicate data synchronously across zones, providing low RPO. A managed instance group with a health check and auto-healing enables fast failover for low RTO. Snapshots have higher RPO. Cloud DNS is for DNS failover, not for compute failover. Global load balancer is for traffic distribution, not stateful failover.

Answer

Set up scheduled snapshots to a multi-regional Cloud Storage bucket

Answer

Use Cloud DNS with a failover policy

Answer

Configure a global HTTP(S) load balancer in front of the application

Question 9

An organization needs to audit all changes to network firewall rules in a GCP project. Which service should be used to capture these changes?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify the configuration or metadata of resources, including changes to firewall rules. When a firewall rule is created, updated, or deleted, an audit log entry is automatically generated with details such as the user, timestamp, and the change made. This makes Cloud Audit Logs the correct service for auditing changes to network firewall rules in a GCP project.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Question 10

Company A runs a containerized application on Google Kubernetes Engine (GKE) with 3 node pools: one for frontend, one for backend, and one for stateful databases. The backend services experience periodic latency spikes. After investigation, they found that the spikes correlate with the node pool autoscaler scaling down nodes. The backend services are deployed as Deployments with resource requests and limits set to 100m CPU and 200Mi memory each. The node pool uses n1-standard-2 machine types. The cluster autoscaler is enabled. What should they do to prevent the latency spikes?

Accepted Answer

Configure a PodDisruptionBudget for the backend Deployment with minAvailable set to a high value.. The latency spikes occur because the cluster autoscaler is terminating nodes that host backend Pods, causing those Pods to be rescheduled and disrupting traffic. A PodDisruptionBudget (PDB) with a high minAvailable value ensures that a minimum number of backend Pods remain available during voluntary disruptions like node scale-down, preventing the sudden loss of capacity that leads to latency spikes. This directly addresses the root cause without disabling autoscaling or misconfiguring scheduling.

Answer

Disable cluster autoscaler for the backend node pool.

Answer

Use node taints and tolerations to isolate the backend services.

Answer

Increase the resource requests for the backend services to ensure they are scheduled on dedicated nodes.