Google PCA Practice Test 50 — 15 Questions

Question 1

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Accepted Answer

1. Verify that the VPC networks have non-overlapping IP ranges.
2. Create a VPC peering connection from Project A to Project B.
3. Create a VPC peering connection from Project B to Project A.
4. Verify the peering status and network connectivity.. VPC peering requires bidirectional connections; both sides must initiate peering. IP ranges must not overlap.

Answer

1. Verify that the VPC networks have non-overlapping IP ranges.
2. Create a VPC peering connection from Project A to Project B.
3. Verify the peering status and network connectivity. (No peering from Project B to Project A)

Answer

1. Create a VPC peering connection from Project A to Project B.
2. Create a VPC peering connection from Project B to Project A.
3. Verify that the VPC networks have non-overlapping IP ranges.
4. Verify the peering status and network connectivity.

Answer

1. Create a VPC peering connection from Project B to Project A.
2. Create a VPC peering connection from Project A to Project B.
3. Verify that the VPC networks have non-overlapping IP ranges.
4. Verify the peering status and network connectivity.

Question 2

Drag and drop the steps to set up a Cloud VPN tunnel between Google Cloud and an on-premises network into the correct order.

Accepted Answer

1. Create a Cloud Router
2. Create a VPN gateway
3. Create a tunnel with the on-premises public IP and pre-shared key
4. Establish BGP sessions. Cloud Router is used for dynamic routing. The tunnel requires the on-premises public IP and pre-shared key.

Answer

1. Create a VPN gateway
2. Create a Cloud Router
3. Establish BGP sessions
4. Create a tunnel with the on-premises public IP and pre-shared key

Answer

1. Create a VPN gateway
2. Create a tunnel with the on-premises public IP and pre-shared key
3. Establish BGP sessions

Answer

1. Create a tunnel with the on-premises public IP and pre-shared key
2. Create a VPN gateway
3. Create a Cloud Router
4. Establish BGP sessions

Question 3

Drag and drop the steps to migrate a Compute Engine VM to a different region using a snapshot into the correct order.

Accepted Answer

Create a snapshot of the existing disk, then create a new disk in the target region from the snapshot, then create a new VM in the target region using that disk.. Snapshots are global resources, but disks are regional. Create the disk in the target region, then create the VM.

Answer

Create a new disk in the target region, then create a snapshot of the existing disk, then create a new VM in the target region using the new disk.

Answer

Create a snapshot of the existing disk, then create a new VM in the target region, then create a new disk in the target region from the snapshot.

Answer

Create a new VM in the target region, then create a snapshot of the existing disk, then create a new disk in the target region from the snapshot.

Question 4

Your company runs a multi-region web application on Google Kubernetes Engine (GKE) with pods that process sensitive user data. The application uses Cloud SQL for PostgreSQL as the backend database. Your security team has implemented the following controls: 1) All traffic to the database is encrypted using SSL/TLS. 2) The GKE cluster uses Workload Identity to bind Kubernetes service accounts to IAM service accounts. 3) The Cloud SQL instance is configured with a public IP address and authorized networks to allow only the GKE cluster's node IP ranges. 4) The database credentials are stored in Secret Manager and mounted as volumes in the pods. Recently, a security audit revealed that a pod was compromised due to a container vulnerability. The attacker was able to exfiltrate sensitive data directly from the Cloud SQL database using the credentials from Secret Manager. The security team wants to prevent such exfiltration in the future while minimizing changes to the application code. Which course of action should you recommend?

Accepted Answer

Deploy Cloud SQL Auth Proxy as a sidecar container in each pod, and configure IAM database authentication to replace static credentials.. Deploying Cloud SQL Auth Proxy as a sidecar container enforces IAM-based authentication, eliminating static credentials that can be exfiltrated. The proxy also handles SSL/TLS encryption automatically and allows fine-grained access control via IAM permissions, so even if a pod is compromised, the attacker cannot reuse stolen credentials because they are tied to the pod's identity via Workload Identity. This approach requires minimal code changes since the application connects to localhost instead of the Cloud SQL public IP.

Answer

Migrate the database to Cloud Spanner, which has built-in IAM integration and automatic encryption.

Answer

Rotate the database password and store the new password in Secret Manager, then update the application to fetch the password from Secret Manager at startup.

Answer

Change the Cloud SQL instance to use a private IP address and disable public access, ensuring only the GKE cluster can reach it via VPC peering.

Question 5

A company runs a web application on Google Kubernetes Engine (GKE) with Cluster Autoscaler enabled. During a traffic spike, the application becomes slow and some requests timeout. The cluster has sufficient CPU and memory headroom. What is the most likely cause and solution?

Accepted Answer

Configure Horizontal Pod Autoscaler (HPA) based on CPU utilization or custom metrics.. The cluster has sufficient CPU and memory headroom, indicating that the issue is not about cluster capacity but about pod-level scaling. The Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU utilization or custom metrics, which directly addresses the application slowdown and timeouts during traffic spikes by distributing the load across more pods.

Answer

Increase the node pool's machine type to a larger size.

Answer

Enable Cluster Autoscaler to add more nodes.

Answer

Deploy the application in a regional cluster for higher availability.

Question 6

A team deployed a new version of a service on Cloud Run. After deployment, users report 502 errors. The logs show "Error: Server Error" with no stack trace. What is the first step the team should take to diagnose the issue?

Accepted Answer

Check the container image for missing dependencies or misconfiguration.. The 502 error with 'Error: Server Error' and no stack trace typically indicates that the container failed to start or crashed immediately after startup, often due to missing dependencies or misconfiguration in the container image. Cloud Run requires the container to listen on the port specified by the PORT environment variable (default 8080) and respond to health checks; if the container exits or fails to bind, Cloud Run returns a 502. Checking the container image is the first diagnostic step because it addresses the most common root cause before investigating runtime or scaling issues.

Answer

Enable Cloud Debugger to inspect the running instance.

Answer

Increase Cloud Run max instances limit.

Answer

Rollback to the previous version immediately.

Question 7

A financial institution deploys a containerized application on GKE with Binary Authorization enabled. They want to ensure that only images signed by their internal CI/CD pipeline are deployed, and they also need to allow a break-glass procedure using a specific image from a curated registry. How should they configure Binary Authorization?

Accepted Answer

Create a policy with a default deny rule, and add a custom rule to allow images from the curated registry.. Binary Authorization policies are deny-by-default, so you must create a custom rule to allow specific images (e.g., from a curated registry) while keeping the default deny rule in place. This satisfies both the requirement to enforce signed images from the CI/CD pipeline and the break-glass procedure using a trusted registry image.

Answer

Create a policy with an evaluation mode to allow all images, but use a whitelist of approved registries.

Answer

Use Cloud Run instead, which has built-in image verification.

Answer

Create a policy with an evaluation mode to require all images to be signed, and configure a Cloud Build attestor.

Question 8

An engineer runs the above command and sees two firewall rules that allow SSH access. A security review requires that SSH access be allowed only from the bastion subnet 10.0.1.0/24. What should the engineer do to meet the requirement?

Accepted Answer

Delete the allow-ssh-ingress rule. The allow-ssh-ingress rule has a higher priority (lower number) than the allow-ssh-from-bastion rule, allowing SSH from any source IP. Deleting this rule ensures that only the lower-priority rule (allow-ssh-from-bastion) remains, which restricts SSH access to the bastion subnet 10.0.1.0/24. In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence, so the allow-ssh-ingress rule (priority 1000) overrides the allow-ssh-from-bastion rule (priority 2000) for any traffic matching both.

Answer

Add a firewall rule with priority 500 that denies SSH from all IPs

Answer

Change the priority of allow-ssh-ingress to 2000

Answer

Remove the target tag 'ssh-allowed' from allow-ssh-from-bastion

Question 9

A company is migrating hundreds of on-premises VMs to Compute Engine. They want to minimize manual effort and downtime. Which service should they use?

Accepted Answer

Migrate for Compute Engine. Migrate for Compute Engine (formerly Velostrata) is the correct choice because it is a fully managed service specifically designed for migrating large-scale VM workloads to Compute Engine with minimal downtime. It uses a streaming migration approach that moves the OS and application data while the source VM continues running, then performs a cutover with near-zero downtime, making it ideal for hundreds of VMs without manual effort.

Answer

Cloud Build

Answer

gcloud compute instances import

Answer

Transfer Appliance

Answer

CloudEndure

Question 10

A company runs a multi-tier web application on Google Kubernetes Engine (GKE) with a frontend service, a backend service, and a Cloud SQL for PostgreSQL database. During peak hours, the frontend pod CPU usage is high (consistently above 80%), while the backend service shows moderate CPU usage (around 50%). Response times for user requests increase significantly, often exceeding the 200ms p99 latency target. Cloud SQL metrics show low query latency and no contention. The team wants to improve performance in a cost-effective manner. Which initial step should they take?

Accepted Answer

Increase the number of frontend pods by adjusting the horizontal pod autoscaler's target CPU utilization.. The frontend pods are CPU-bound during peak hours, causing increased response times. Increasing the number of frontend pods via the Horizontal Pod Autoscaler (HPA) by lowering the target CPU utilization threshold distributes the load across more replicas, directly addressing the bottleneck without additional infrastructure cost. This is the most cost-effective initial step because it leverages existing resources and autoscaling capabilities.

Answer

Add a read replica for Cloud SQL to offload read queries.

Answer

Migrate the backend service to a custom machine type with more vCPUs.

Answer

Enable vertical pod autoscaling for the backend service.

Question 11

A developer is deploying a containerized application to Cloud Run. The deployment fails with the error above. What is the most likely cause?

Accepted Answer

The container is listening on port 3000 instead of 8080.. Cloud Run requires containers to listen on the port defined by the `PORT` environment variable, which defaults to 8080. If the container is hardcoded to listen on port 3000, Cloud Run's health checks and routing will fail because the runtime cannot reach the application on the expected port, causing the deployment to fail.

Answer

The container health check is misconfigured.

Answer

The container startup script fails.

Answer

The container does not have a web server.

Question 12

A financial services company runs a mission-critical database on Compute Engine with local SSDs. They need to ensure data durability in case of an instance failure while maintaining low latency. What should they do?

Accepted Answer

Configure a regional persistent disk with synchronous replication and attach it to the instance. Regional persistent disks (PD) provide synchronous replication of data between two zones in the same region, ensuring data durability even if the entire zone fails. By attaching a regional PD to a Compute Engine instance, you maintain low latency (since the disk is network-attached but still within the same region) while achieving the required durability. Local SSDs, while offering very low latency, are ephemeral and lose data on instance failure, so they are not suitable for mission-critical durability requirements.

Answer

Use a managed instance group with autohealing and store data on a persistent disk

Answer

Set up a read replica in another zone using database-native replication

Answer

Take regular snapshots of the local SSDs to Cloud Storage

Question 13

A company needs to deploy a stateless web application that can handle variable traffic. Which compute option is the most cost-effective and scales automatically?

Accepted Answer

App Engine standard environment with automatic scaling.. App Engine standard environment with automatic scaling is the most cost-effective and automatically scales to zero when there is no traffic, making it ideal for variable traffic stateless web applications. It abstracts infrastructure management, charges only for resources used, and handles scaling instantly without provisioning overhead.

Answer

Google Kubernetes Engine (GKE) with cluster autoscaling.

Answer

Compute Engine with managed instance groups and autoscaling.

Answer

Compute Engine with preemptible VMs.

Answer

Cloud Run with CPU always allocated.

Question 14

An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?

Accepted Answer

Cloud DLP. Cloud DLP (option C) is correct because it provides native content inspection and de-identification (redaction) of sensitive data like credit card numbers using built-in infoType detectors. Cloud Functions (option D) is correct because it can be triggered by Cloud Storage events (e.g., finalize/create) to invoke the DLP API on newly uploaded CSV files, enabling serverless, event-driven processing without managing infrastructure.

Answer

Cloud Dataflow

Answer

Cloud Run

Answer

BigQuery

Question 15

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Accepted Answer

Grant the service account roles/storage.objectViewer on the bucket and remove all other bindings.. The principle of least privilege dictates that the service account should be granted only the minimal permissions required to read objects, which is roles/storage.objectViewer. By removing all other bindings, the bucket becomes accessible exclusively to that service account, ensuring that no other identities (users, groups, or other service accounts) can read the sensitive data. This approach directly enforces the requirement using IAM roles on the bucket resource.

Answer

Grant the service account roles/iam.serviceAccountUser on the bucket.

Answer

Use a signed URL to allow access for the service account.

Answer

Grant the service account roles/storage.admin on the bucket.