Google PCA Practice Test 50 — 15 Questions

Question 1

A retail company runs a stateless web front end on a managed instance group of Compute Engine VMs behind an external Application Load Balancer. Traffic has grown, and the operations team wants to reduce the cost of idle capacity while still absorbing sharp, unpredictable spikes in user requests. They also want to avoid managing a separate autoscaling policy for each instance group. Which provisioning approach should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the front end on Cloud Run with a serverless network endpoint group as the Application Load Balancer backend, letting Cloud Run scale instances automatically from zero request-based capacity.. The requirement is to cut idle capacity cost while absorbing unpredictable spikes without maintaining per-group autoscaling policies. Cloud Run provides request-driven autoscaling that can scale to zero and back out rapidly, and a serverless network endpoint group lets the existing external Application Load Balancer keep fronting the service. This removes idle VM cost and centralizes elasticity in the platform rather than in hand-tuned policies.

Answer

Configure the existing managed instance group with a CPU utilization autoscaling policy and set the minimum replicas to the peak observed load.

Answer

Create a second managed instance group in a different region and use an external proxy Network Load Balancer to split traffic manually.

Answer

Replace the managed instance group with a single large Compute Engine VM using a committed use discount to lower the hourly rate.

Question 2

A startup is deploying a new web application on Google Cloud. They want to minimize operational overhead and ensure the application scales automatically based on traffic. They also want to pay only for what they use. Which Google Cloud service should the architect recommend?

Accepted Answer

Cloud Run.. Cloud Run is a fully managed serverless platform that automatically scales based on traffic, scales to zero, and charges only for resources used during request processing. It requires no infrastructure management, making it ideal for minimizing operational overhead while meeting autoscaling and pay-per-use requirements.

Answer

Compute Engine managed instance groups with autoscaling.

Answer

App Engine standard environment.

Answer

Google Kubernetes Engine (GKE) with cluster autoscaler.

Question 3

You are responsible for operations reliability of a production service running on Google Cloud. The service is deployed on GKE and exposes an external HTTPS endpoint through an external Application Load Balancer. You need to implement monitoring that detects when the service is unhealthy from the user's perspective and alerts the on-call team. (Choose two.)

Accepted Answer

Set up an alerting policy on the load balancer's 5xx error rate and on backend latency, with thresholds tied to the service level objective.. Detecting user-facing unhealthiness requires probing the service as users reach it and monitoring the error and latency signals that reflect their experience. An uptime check from multiple locations validates the public endpoint and response content, while alerting on load balancer 5xx rates and backend latency ties detection to SLO thresholds. Together they catch both total outages and degraded performance.

Answer

Create an alerting policy on the Application Load Balancer's request count metric to fire when traffic drops below a static threshold.

Answer

Enable Cloud Trace on the GKE workloads and alert when the number of spans per minute exceeds a fixed value.

Answer

Configure a log-based alert on GKE node system logs for the keyword 'OOMKilled'.

Question 4

A startup runs a customer-facing web application on Cloud Run. The operations team needs to know when the service's request latency exceeds a threshold so they can respond before users complain. They want to be notified by email and also want a record of the incident for later review. Which Google Cloud service should they use to define the alerting policy?

Accepted Answer

Cloud Monitoring alerting policies with a notification channel for email.. Cloud Monitoring alerting policies are designed to evaluate metrics like request latency against thresholds and to notify through channels such as email. They also track incidents over time, satisfying the need for both immediate notification and a reviewable record. Log-based alerts, Cloud Trace reports, and traffic splitting serve different purposes and do not provide threshold-based latency alerting with email notification.

Answer

Cloud Trace analysis reports scheduled to run daily and emailed to the operations team.

Answer

Cloud Run revision traffic splitting combined with a health check endpoint that returns an error when latency is high.

Answer

Cloud Logging log-based alerts with a notification channel for email.

Question 5

A company runs a microservices application on Google Kubernetes Engine (GKE). They want to ensure that each service can only communicate with the services it explicitly depends on, and they need to enforce this at the network layer without modifying application code. They also want to monitor allowed and denied traffic. What should they do?

Accepted Answer

Implement Kubernetes Network Policies and enable GKE network policy logging.. Kubernetes Network Policies provide pod-level network segmentation and are enforced by the container network interface (CNI) plugin. GKE supports network policy logging, which records allowed and denied connections. This approach does not require application code changes and operates at the network layer.

Answer

Use Istio service mesh with mutual TLS and authorization policies.

Answer

Use Anthos Service Mesh with access logging and policy enforcement.

Answer

Configure firewall rules in the VPC to allow only specific traffic between nodes.

Question 6

Your organization runs a critical application on Compute Engine. The monthly bill shows sustained use discounts but the finance team wants to reduce costs further. The workload runs 24/7 with predictable usage for at least the next 12 months. You need to achieve the maximum possible discount without affecting performance or availability. What should you do?

Accepted Answer

Purchase a 1-year commitment for the specific vCPU and memory machine types used.. Committed use discounts offer substantial savings for predictable workloads. Because the application runs continuously for at least a year, committing to the specific resources ensures the highest discount without impacting performance or availability. Other options either compromise reliability or do not provide additional savings beyond existing discounts.

Answer

Switch all instances to preemptible VMs to get the largest discount.

Answer

Enable automatic sustained use discounts by ensuring instances run for the full month.

Answer

Migrate the workload to a managed instance group with autoscaling.

Question 7

A financial services firm stores sensitive customer transaction data in Cloud Storage buckets. The security team wants to ensure that the data is encrypted at rest with a key that the firm controls, and that the key is automatically rotated every 90 days. They also need to be able to revoke access to the data immediately by disabling the key. Which Google Cloud service and configuration should they use?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS, set a rotation period of 90 days, and disable the key to revoke access.. Customer-Managed Encryption Keys (CMEK) with Cloud KMS allow organizations to control the encryption keys used for data at rest in Cloud Storage. You can set an automatic rotation period, such as 90 days, and disabling the key immediately revokes access to the data. This satisfies the requirements for control, automatic rotation, and immediate revocation.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and store the keys in a secure vault, rotating them manually every 90 days.

Answer

Use Google-managed encryption keys and configure a Cloud Scheduler job to rotate the keys every 90 days.

Answer

Use Cloud HSM to generate keys, and configure Cloud Storage to use those keys with a 90-day rotation policy.

Question 8

Your company is deploying a multi-tier application on Google Cloud. The application consists of a web frontend running on Compute Engine instances, a backend API running on Google Kubernetes Engine (GKE), and a Cloud SQL for MySQL database. You need to design the network architecture to ensure that the web frontend can communicate with the backend API, and the backend API can access the Cloud SQL database, while minimizing exposure to the public internet. Which two design choices should you implement? (Choose two.)

Accepted Answer

Place the web frontend and backend API in the same VPC network but different subnets, and configure firewall rules to allow traffic only from the frontend subnet to the backend API on the required port.. The correct choices are to place both tiers in the same VPC with firewall rules restricting traffic, and to enable Private Service Access for Cloud SQL. This ensures internal communication without public internet exposure. Using a single VPC simplifies security, and Private Service Access provides private connectivity to Cloud SQL, meeting the requirement to minimize public exposure.

Answer

Use Cloud VPN to connect the web frontend and backend API over an encrypted tunnel, even though they are in the same Google Cloud region.

Answer

Assign external IP addresses to all Compute Engine instances and GKE nodes, and use firewall rules to restrict access to specific source IP ranges.

Answer

Create a separate VPC network for each tier and use VPC peering to connect them, then configure firewall rules to allow traffic between the peered networks.

Question 9

Your team is responsible for a production service running on Google Cloud. You need to define Service Level Objectives (SLOs) and monitor them using Cloud Monitoring. You want to be alerted when the service's error budget is being consumed too quickly. Which approach should you take?

Accepted Answer

Use Cloud Monitoring's SLO monitoring to define an SLO with a 99.9% availability target, and create an alerting policy based on the burn rate of the error budget.. Cloud Monitoring's SLO monitoring feature allows you to define SLOs and then create alerting policies based on error budget burn rates. This is the most effective way to alert on SLO violations because it considers both the error rate and the time window, and it can detect when the budget is being consumed too quickly. Other methods lack the direct integration with SLOs and error budgets.

Answer

Set up a log-based metric that counts errors, and create an alert when the count exceeds a certain number within a 5-minute window.

Answer

Configure a dashboard in Cloud Monitoring that displays the error rate and set up a cron job to check the dashboard every hour and send an email if the error rate is high.

Answer

Create an alerting policy that triggers when the error rate exceeds a threshold of 1% over a 1-hour window.

Question 10

Your company runs a production microservices application on GKE Standard. The operations team wants to be notified when any pod in the cluster is repeatedly restarting, indicating a potential CrashLoopBackOff. They want to use Cloud Monitoring to create an alert that fires when a container restarts more than 5 times in a 10-minute window. Which metric should they use as the basis for the alerting policy?

Accepted Answer

kubernetes.io/container/restart_count. The kubernetes.io/container/restart_count metric directly tracks container restarts and is the correct choice for alerting on repeated restarts. It is a cumulative counter, so you must apply a rate or delta alignment to detect increases over time. Other metrics like CPU usage or pod status do not provide restart counts, and log-based metrics require extra setup and may be less reliable.

Answer

kubernetes.io/container/cpu/core_usage_time

Answer

kubernetes.io/pod/status

Answer

logging.googleapis.com/user/restart_count

Question 11

Your team is deploying a stateful web application on Google Kubernetes Engine (GKE). The application requires each replica to have a stable network identity and its own persistent disk that survives pod restarts. You also need to ensure that the persistent disk is automatically provisioned and attached. Which GKE feature should you use?

Accepted Answer

StatefulSet with a PersistentVolumeClaim template. StatefulSets are the correct choice for stateful applications on GKE because they provide stable network identities and persistent storage per replica. The volumeClaimTemplates automatically create PVCs, which dynamically provision persistent disks. Deployments, DaemonSets, and CronJobs lack these features, making them unsuitable for this scenario.

Answer

DaemonSet with hostPath volumes

Answer

Deployment with a PersistentVolumeClaim

Answer

CronJob with a PersistentVolumeClaim

Question 12

A retail company runs a Black Friday promotion and expects a burst of read traffic against a product-catalog database. The application is read-heavy, tolerates slightly stale data, and the team wants to scale reads horizontally without changing application code. They are using Cloud SQL for MySQL. Which design should the architect recommend?

Accepted Answer

Configure a Cloud SQL read replica in the same region and point read queries at its IP address. Read replicas are the native Cloud SQL for MySQL mechanism for horizontal read scaling with asynchronous replication. Because the application tolerates slightly stale data, the replication lag is acceptable, and no code changes are needed beyond pointing read connections at the replica. A high-availability standby is not readable, Firestore requires a rewrite, and vertical scaling does not scale reads horizontally.

Answer

Enable Cloud SQL high availability by adding a standby instance and send read queries to the standby

Answer

Increase the primary instance's vCPU count and memory to absorb the read burst

Answer

Migrate the catalog to Firestore in Native mode and let the client SDK cache reads

Question 13

Your company uses a CI/CD pipeline that builds container images and stores them in Artifact Registry. The images are deployed to Google Kubernetes Engine (GKE). You need to ensure that only images that have been scanned for vulnerabilities and approved by a security team can be deployed to the production GKE cluster. You want to enforce this policy automatically without modifying the CI/CD pipeline. What should you do?

Accepted Answer

Enable Binary Authorization on the GKE cluster and configure a policy that requires attestations from the security team's attestor.. Binary Authorization enforces deploy-time policies on GKE by requiring cryptographic attestations that prove an image was scanned and approved. The security team can sign attestations after scanning, and the GKE cluster will only admit images with valid attestations. This meets the requirement without altering the CI/CD pipeline and provides automated enforcement.

Answer

Configure a Kubernetes admission webhook that calls the security team's API to validate each image before deployment.

Answer

Restrict Artifact Registry permissions so that only the security team can push images to the production repository.

Answer

Use Container Analysis to scan images and set a vulnerability threshold that blocks deployment if any critical vulnerability is found.

Question 14

Your company is deploying a new application on Google Cloud and needs to ensure that it can meet a 99.9% availability SLA. You are designing the architecture for high availability. Which two practices should you implement? (Choose two.)

Accepted Answer

Implement health checks and autohealing for managed instance groups.. To achieve high availability, you should deploy across multiple zones within a region to survive zone failures and implement health checks with autohealing to automatically recover from instance failures. These two practices together ensure that the application remains available even when individual instances or zones fail, helping to meet a 99.9% SLA.

Answer

Use a single global load balancer to distribute traffic across all instances.

Answer

Use a single zone with a high-capacity machine type to reduce complexity.

Answer

Store application state on a local SSD attached to each instance.

Question 15

A healthcare company is designing a system to process sensitive patient records on Google Cloud. They need to ensure that data is encrypted at rest with keys they control and can rotate on demand. They also require that the encryption keys are stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. Which Google Cloud service should they use?

Accepted Answer

Cloud HSM with Cloud KMS. Cloud HSM with Cloud KMS provides hardware security module-backed keys that are FIPS 140-2 Level 3 validated. It allows you to control key rotation and use them for encryption at rest across Google Cloud services. Google-managed keys do not give customer control, CMEK with standard Cloud KMS does not guarantee HSM storage, and CSEK requires external key management without HSM integration.

Answer

Google-managed encryption keys

Answer

Customer-managed encryption keys (CMEK) with Cloud KMS

Answer

Customer-supplied encryption keys (CSEK)