Google PCA Practice Questions 2 — 50 Questions

Question 1

An organization is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single server with an on-premises database. The application is stateful and requires low-latency access to the database. The migration must minimize downtime and ensure high availability. Which architecture should the company adopt?

Accepted Answer

Deploy on Compute Engine with a regional persistent disk and use Cloud SQL for PostgreSQL with regional high availability.. Option B is correct because it combines Compute Engine with a regional persistent disk for synchronous replication across zones, ensuring high availability with minimal downtime during a zonal failure. Cloud SQL for PostgreSQL with regional high availability provides a managed, low-latency database with automatic failover, meeting the stateful application's need for low-latency access and high availability without the complexity of container orchestration.

Answer

Deploy on GKE with StatefulSets and use Cloud Spanner for global consistency.

Answer

Deploy on App Engine Standard Environment and use Cloud Firestore in Datastore mode.

Answer

Deploy on Cloud Run and use Cloud SQL with read replicas.

Question 2

A company uses Cloud SQL for MySQL to host its production database. The database experiences high read traffic. The team wants to improve read performance without modifying the application. What should they do?

Accepted Answer

Add read replicas and configure the application to use them for read queries.. Option C is correct because adding read replicas offloads read queries from the primary Cloud SQL instance, distributing the read load across multiple replicas. This improves read performance without any application code changes, as the application can be configured to direct read queries to the replica endpoints. Cloud SQL for MySQL replicas use asynchronous replication, ensuring near-real-time data consistency for read-heavy workloads.

Answer

Increase the number of CPUs on the primary Cloud SQL instance.

Answer

Use Cloud SQL Proxy with connection pooling.

Answer

Enable automatic storage increase to allow more data.

Question 3

A company is running a critical application on Compute Engine. The application writes logs to a local persistent disk. The operations team wants to ensure logs are not lost if the VM fails. What should they do?

Accepted Answer

Configure the application to write logs to Cloud Logging using the Logging agent.. Option D is correct because Cloud Logging with the Logging agent provides a centralized, durable, and managed log storage solution. The agent streams logs from the VM to Cloud Logging in near real-time, ensuring logs are preserved even if the VM or its local persistent disk fails. This decouples log storage from the VM's lifecycle, meeting the operations team's requirement for log durability.

Answer

Use a regional persistent disk to replicate data across zones.

Answer

Schedule persistent disk snapshots every 5 minutes.

Answer

Create a script to copy logs to a Cloud Storage bucket every minute.

Question 4

Which TWO options are best practices for ensuring high availability of an application running on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across multiple zones.. Option A is correct because pod anti-affinity ensures that pods from the same application are scheduled on different nodes across multiple zones, reducing the blast radius of a zonal failure. This is a key pattern for achieving high availability in GKE, as it prevents a single zone outage from taking down all replicas of your application.

Answer

Deploy all nodes in the same zone to simplify networking.

Answer

Prefer using preemptible VMs for cost savings.

Answer

Use a single zonal cluster to avoid cross-zone latency.

Question 5

Which TWO statements about Google Cloud VPC networks are true? (Choose two.)

Accepted Answer

Subnets are regional resources.. Subnets in Google Cloud VPC are regional resources. When you create a subnet, you specify a region and a CIDR block, and the subnet spans all zones within that region. This allows resources in different zones of the same region to use the same subnet without additional configuration.

Answer

VPC networks are project-level resources.

Answer

Firewall rules are regional.

Answer

Subnets are zonal resources.

Question 6

An organization has multiple projects in Google Cloud and wants to centralize logging and monitoring for all projects. They need to aggregate logs from all projects into a single project for analysis. Which approach should they use?

Accepted Answer

Create a logs sink in each project that exports logs to a BigQuery dataset in the central project.. Option D is correct because Google Cloud's logs sink feature allows you to route logs from multiple source projects to a centralized BigQuery dataset in a single destination project. This approach aggregates logs efficiently without requiring agents or manual import steps, and it supports real-time log export for analysis.

Answer

Export logs from each project to a Cloud Storage bucket and then import them into BigQuery.

Answer

Enable Cloud Audit Logs for all projects and view them from the central project.

Answer

Install the Stackdriver agent on all VMs and point them to the central project.

Question 7

A company wants to migrate on-premises workloads to Google Cloud. They need to assess the existing infrastructure, plan the migration, and track progress. Which tool should they use?

Accepted Answer

Migrate for Compute Engine.. Migrate for Compute Engine (formerly Velostrata) is the correct tool because it is specifically designed to assess, plan, and migrate on-premises workloads to Google Cloud. It provides discovery of existing infrastructure, generates migration plans, and tracks progress through a dashboard, directly addressing the need for assessment, planning, and tracking.

Answer

Cloud Endpoints.

Answer

Cloud Deployment Manager.

Answer

Cloud Foundation Toolkit.

Question 8

You are designing a CI/CD pipeline for a containerized application on Google Cloud. The application is built with Cloud Build, stored in Container Registry, and deployed to GKE. The team wants to ensure that only images that pass vulnerability scanning are deployed. What should you do?

Accepted Answer

Add a step in Cloud Build that runs a vulnerability scanner on the image and fails the build if vulnerabilities exceed a threshold.. Option A is correct because Cloud Build can include a custom step that runs a vulnerability scanner (e.g., using the Google Cloud `gcloud container images list-tags` with the `--show-occurrences-from` flag or a third-party tool like Trivy) and then evaluates the results against a threshold. If the scan finds vulnerabilities exceeding the defined threshold, the build step exits with a non-zero status, causing the Cloud Build pipeline to fail and preventing the image from being pushed to Container Registry or deployed. This directly enforces the requirement that only images passing vulnerability scanning proceed in the CI/CD pipeline.

Answer

Configure Container Analysis to automatically scan images in Container Registry and block deployment via a webhook.

Answer

Enable Binary Authorization on the GKE cluster and configure a policy to require an attestation from a trusted authority.

Answer

Use Security Command Center to detect vulnerabilities and alert the team to manually block deployments.

Question 9

Which TWO statements are true about Google Cloud HTTPS Load Balancers?

Accepted Answer

They can forward traffic to backends in multiple regions, including instances in different VPC networks.. Option C is correct because Google Cloud HTTPS Load Balancers are global external load balancers that can distribute traffic to backends across multiple regions, and they support cross-VPC connectivity via Shared VPC or VPC Network Peering, allowing instances in different VPC networks to serve as backends.

Answer

They support only external backends, such as internet-facing instances.

Answer

They support only IPv4 traffic.

Answer

They can be used to load balance internal HTTP(S) traffic within a VPC.

Question 10

A company runs a data analytics platform on Google Cloud using BigQuery, Dataflow, and Cloud Storage. They notice that Dataflow jobs are failing with 'out of memory' errors for certain large pipelines. The pipelines process variable amounts of data, sometimes spiking 10x normal. Which strategy should they use to handle these spikes cost-effectively?

Accepted Answer

Configure the Dataflow pipeline to use autoscaling with a higher maximum number of workers and use preemptible VMs for cost savings.. Option C is correct because Dataflow's autoscaling can dynamically add workers to handle sudden data spikes, and using preemptible VMs significantly reduces cost for batch pipelines that can tolerate interruptions. This approach avoids manual intervention and over-provisioning, making it cost-effective for variable workloads.

Answer

Manually monitor the job and increase the number of workers when a spike is detected.

Answer

Increase the machine type of the workers to a high-memory type and disable autoscaling.

Answer

Use Dataflow Streaming Engine to offload state to persistent storage and reduce memory usage.

Question 11

A startup deploys a web application on Compute Engine instances behind an HTTP load balancer. They need to handle unpredictable spikes in traffic with minimal operational overhead. What is the simplest scaling approach?

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization. Using a managed instance group with autoscaling automatically adds/removes instances based on demand, requiring minimal manual intervention. Other options either require more complex setup or are not optimal.

Answer

Set up a Kubernetes cluster with horizontal pod autoscaling

Answer

Migrate the application to Cloud Run

Answer

Add more instances manually during peak hours

Question 12

A development team uses Cloud Build for their CI/CD pipeline. They want to reduce build times. Which action is most effective?

Accepted Answer

Enable parallel builds by separating build steps into multiple jobs. Enabling parallel builds by separating build steps into multiple jobs reduces total build time by running independent steps concurrently. Other options are less effective or add complexity.

Answer

Store build artifacts in a Cloud Storage bucket and reuse them

Answer

Use more powerful build machines by specifying larger machine types

Answer

Use a Cloud Run service to run builds asynchronously

Question 13

Refer to the exhibit. A team wants to grant the ability to run queries (but not modify) on BigQuery datasets to a new set of users who have email addresses in the 'example.com' domain. What is the simplest way to achieve this?

Accepted Answer

No action needed; new users with 'example.com' accounts already have the dataViewer role through the existing domain membership. The domain 'example.com' is already bound to the dataViewer role, so any user with an email in that domain automatically has query access. No action is needed.

Answer

Create a new binding with role 'roles/bigquery.dataViewer' and include the new users as members

Answer

Remove the domain binding and only grant access to individual users

Answer

Add the new users to the existing 'domain:example.com' member list

Question 14

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to optimize costs without sacrificing availability. They have varying traffic patterns. Which strategy should they recommend?

Accepted Answer

Use node auto-provisioning with preemptible nodes.. Node auto-provisioning with preemptible nodes automatically creates node pools based on workload demands and uses cheaper preemptible VMs, reducing cost for variable traffic. Regional clusters focus on high availability, not cost. Committed use discounts lock in usage and are not optimal for variable traffic. GKE Autopilot provides convenience but may not be the most cost-efficient with preemptible options.

Answer

Use committed use discounts with a 3-year term on all nodes.

Answer

Use GKE Autopilot with a single node pool.

Answer

Use a regional cluster with node pools of different machine types.

Question 15

A company runs a large-scale data processing pipeline using Dataflow with streaming data from Pub/Sub. They notice increasing costs due to high data shuffle operations. They want to optimize the pipeline performance and cost. Which approach should they take?

Accepted Answer

Optimize the pipeline by partitioning data and using Combine transforms.. Optimizing pipeline logic to minimize shuffle reduces resource usage and cost. Increasing workers or using larger machine types may improve performance but increase cost. Switching to batch mode would lose real-time processing capability.

Answer

Use a larger machine type for workers.

Answer

Increase the number of workers to reduce shuffle.

Answer

Switch to batch mode overnight.

Question 16

Which TWO actions reduce egress costs when transferring data from Compute Engine to the internet? (Choose 2)

Accepted Answer

Use Cloud CDN to cache content. Options A and D are correct. Using a Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network does not reduce egress costs; it may increase. Compressing data reduces egress volume, but it's not always applicable and may affect latency. Moving to a different region does not reduce egress cost. There are only two correct: A and D. Actually, compressing data reduces the amount of data transferred, so that reduces egress cost. Let's reconsider. The correct answers: Using Cloud CDN (caches content, reduces origin egress) and using data compression (reduces size). Option A is correct, option D is correct. Option B (move to lower-cost region) does not reduce egress cost because egress is per GB, same worldwide. Option C (use Premium Tier) increases cost. Option E (use a NAT gateway) does not reduce egress.

Answer

Use Cloud NAT for outbound traffic

Answer

Move instances to a lower-cost region

Answer

Use Premium Tier networking

Question 17

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Question 18

Drag and drop the steps to migrate a Compute Engine VM to a different region using a snapshot into the correct order.

Question 19

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Accepted Answer

The service account lacks IAM permissions to read from Cloud Storage. Option A is correct because the scopes=cloud-platform grants all cloud API scopes, but authentication may fail if the service account does not have the proper IAM permissions (e.g., storage.objectViewer). Option B is wrong because pd-ssd is fine. Option C is wrong because the tags are for firewall rules, not storage access. Option D is wrong because the SA is specified.

Answer

The service account is not attached to the instance

Answer

The tags http-server and https-server block outbound traffic

Answer

The boot disk type is SSD, which is not compatible with Cloud Storage

Question 20

Drag and drop the steps to configure a Cloud Load Balancer with a backend service consisting of Compute Engine instances into the correct order.