Google PCA Practice Exam 51 — 20 Questions

Question 1

A company is using Cloud Bigtable for time-series data from IoT devices. They are experiencing high latency for queries that scan a large range of rows. Which THREE actions can improve query performance? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reduce the size of row keys.. Reducing the size of row keys (A) improves query performance because Bigtable stores rows sorted by key, and smaller keys reduce the amount of data that must be scanned and transferred during range scans. This directly lowers I/O and network overhead, which is critical for time-series data where row keys often include timestamps and device IDs.

Answer

Use Key Visualizer to analyze access patterns.

Answer

Switch from SSD storage to HDD storage.

Question 2

A company is deploying a web application on Compute Engine behind a global HTTP(S) load balancer. They want to restrict access to only traffic from specific IP ranges. Which load balancer feature should they use?

Accepted Answer

Cloud Armor security policies.. Cloud Armor security policies are the correct choice because they allow you to define IP-based allow/deny rules at the edge of Google's network, directly integrated with the global HTTP(S) load balancer. This provides granular access control based on source IP ranges before traffic reaches your backend instances, which is exactly what the requirement specifies.

Answer

VPC firewall rules.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud CDN.

Question 3

A team is using Cloud Build to deploy a microservice to Cloud Run. They want to ensure that only containers built from a specific trusted branch in their source repository are deployed to production. Which Cloud Build feature should they use?

Accepted Answer

Cloud Build trigger branch filtering. Cloud Build triggers can be configured to respond only to specific branches (e.g., 'main' or 'release/*'). By setting the trigger's included files filter and branch regex, they can restrict builds to that branch. Artifact Registry controls access to container images, but does not restrict deployment by branch. Cloud Deploy is a separate service for progressive delivery. Binary Authorization enforces policies at deployment time but does not filter by branch.

Answer

Binary Authorization attestors

Answer

Cloud Deploy delivery pipeline approvals

Answer

Artifact Registry IAM permissions

Question 4

A company is migrating its on-premises MongoDB database to Google Cloud. They want a fully managed, highly available NoSQL database that is compatible with MongoDB drivers. Which Google Cloud service should they choose?

Accepted Answer

MongoDB Atlas on Google Cloud Marketplace. MongoDB Atlas via Google Cloud Marketplace is a fully managed MongoDB service that runs on Google Cloud and is compatible with MongoDB drivers. Cloud Bigtable and Firestore are not MongoDB-compatible. Cloud SQL is relational.

Answer

Cloud Firestore

Answer

Cloud Bigtable

Answer

Cloud SQL

Question 5

A developer wants to store and retrieve non-relational data with flexible schema and automatic scaling. Which Google Cloud service should they use?

Accepted Answer

Firestore.. Firestore is a NoSQL document database that supports flexible schema and automatic scaling, making it ideal for non-relational data. It offers real-time synchronization, offline support, and serverless scaling, which aligns with the requirement for storing and retrieving data without manual sharding or capacity planning.

Answer

Cloud Bigtable.

Answer

Cloud SQL.

Answer

Cloud Spanner.

Question 6

A company uses Cloud CDN to accelerate content delivery for their global user base. They notice a low cache hit ratio, and they also need to deliver personalized content based on user geolocation. What should they do?

Accepted Answer

Set appropriate Cache-Control headers and use cache keys including the 'User-Geo' header. Setting appropriate Cache-Control headers (e.g., s-maxage, private vs. public) allows Cloud CDN to cache content effectively, while including the 'User-Geo' header in cache keys enables the CDN to serve different cached responses based on the user's geolocation. This approach balances caching efficiency with personalized content delivery, as the CDN can cache a separate copy for each geographic region without requiring a cache miss for every request.

Answer

Configure cache keys based on URL and query parameters

Answer

Use signed URLs for personalized content

Answer

Serve personalized content from the origin and use Cloud CDN only for static content

Question 7

Which TWO controls should a financial services company implement to comply with PCI DSS requirement related to protecting cardholder data stored in Cloud SQL? (Choose two.)

Accepted Answer

Enable Cloud SQL encryption with Customer-Managed Encryption Keys (CMEK).. PCI DSS requires encryption of cardholder data at rest, and Cloud SQL with Customer-Managed Encryption Keys (CMEK) allows the company to manage and control the encryption keys used to protect data stored in the database. This meets the requirement for strong cryptography and key management, ensuring that even if the underlying storage is compromised, the data remains unreadable.

Answer

Use Cloud DLP to redact cardholder data in logs.

Answer

Enable Cloud Audit Logs to monitor access to the database.

Answer

Configure VPC Service Controls to restrict egress from the Cloud SQL instance.

Question 8

A company is running a web application on Compute Engine instances that average 20% CPU utilization. They want to reduce costs without impacting performance. What is the most effective action?

Accepted Answer

Rightsize instances to a smaller machine type based on usage metrics.. The instances are averaging only 20% CPU utilization, indicating they are over-provisioned. Rightsizing to a smaller machine type directly reduces the compute cost per instance while maintaining adequate performance for the current workload, as the smaller instance can handle the existing load without degradation.

Answer

Change instance type to e2-standard-4.

Answer

Purchase 3-year committed use discounts.

Answer

Use preemptible instances for all traffic.

Question 9

A company uses Cloud SQL for MySQL to host its production database. The database experiences high read traffic. The team wants to improve read performance without modifying the application. What should they do?

Accepted Answer

Add read replicas and configure the application to use them for read queries.. Adding read replicas offloads read queries from the primary Cloud SQL instance, distributing the read load across multiple replicas. This improves read performance without any application code changes, as the application can be configured to direct read queries to the replica endpoints. Cloud SQL for MySQL replicas use asynchronous replication, ensuring near-real-time data consistency for read-heavy workloads.

Answer

Increase the number of CPUs on the primary Cloud SQL instance.

Answer

Use Cloud SQL Proxy with connection pooling.

Answer

Enable automatic storage increase to allow more data.

Question 10

An organization has multiple Google Cloud projects that need to access a shared Cloud SQL database. The database should only be accessible from authorized projects. What is the most secure way to grant access?

Accepted Answer

Configure the Cloud SQL instance with a private IP in a shared VPC and grant IAM roles to the authorized projects.. Using a private IP in a shared VPC ensures that Cloud SQL is not exposed to the public internet, and IAM roles (e.g., roles/cloudsql.client) allow fine-grained access control at the project level. This approach leverages VPC peering or shared VPC to restrict network access exclusively to authorized projects, eliminating the need for public IPs or complex VPN configurations while maintaining high security.

Answer

Use Cloud SQL Proxy on each project's Compute Engine instances.

Answer

Expose the Cloud SQL instance on a public IP and authorize the IP ranges of the projects.

Answer

Set up a Cloud VPN between each project's VPC and the VPC hosting Cloud SQL.

Question 11

A media company uses Cloud CDN with an HTTP(S) Load Balancer to serve video content from Cloud Storage. After a month, they notice increased costs due to high cache miss rates. Analysis shows that many requests include a unique query parameter for analytics tracking. What is the most effective way to improve cache hit ratio while preserving analytics data?

Accepted Answer

Configure a custom cache key on the backend bucket to exclude the analytics parameter. When query parameters are unique per request (like tracking IDs), they cause cache misses. The solution is to define a cache key that ignores that specific parameter, so the same content is cached once. Setting a custom cache key on the backend bucket is the correct approach. Disabling CDN or increasing TTL does not solve the parameter issue. Removing caching altogether would hurt performance and increase egress costs.

Answer

Move the content to a different Cloud Storage bucket with no caching

Answer

Increase the minimum TTL on the backend bucket to 1 hour

Answer

Disable caching for requests with query parameters

Question 12

A company hosts a web application on Compute Engine behind a global HTTP(S) load balancer. They notice that some users experience high latency from certain regions. They want to improve performance without adding complexity. What should they do?

Accepted Answer

Enable Cloud CDN. Enabling Cloud CDN caches content at Google's globally distributed edge caches, reducing latency for users in regions far from the origin Compute Engine instances. This directly addresses the high-latency issue without adding complexity, as it requires no changes to the application architecture and is a simple configuration toggle on the load balancer backend bucket or backend service.

Answer

Add more instances in the same region

Answer

Use Premium Tier networking

Answer

Enable Cloud Armor

Question 13

A company is migrating a monolithic application to Google Cloud. The application consists of a stateful service that writes to local disk and a stateless web server. They want to minimize changes to the code. Which architecture should they use?

Accepted Answer

Lift and shift to Compute Engine instances with persistent disks for stateful service. It represents a lift-and-shift migration that minimizes code changes by running the monolithic application on Compute Engine instances. The stateful service can use persistent disks for local disk writes, while the stateless web server runs on the same or separate instances, preserving the existing architecture without refactoring.

Answer

Run the entire application on Cloud Run and use Cloud Filestore for shared state

Answer

Use App Engine Flexible Environment for the web server and Cloud SQL for state

Answer

Refactor the application into microservices and deploy on GKE with StatefulSets

Question 14

Refer to the exhibit. An engineer notices that the instance 'instance-1' is running but does not serve web traffic on port 80. The instance was created with the provided metadata and scheduling configuration. What is the most likely reason the web server is not responding?

Accepted Answer

The firewall rules do not allow ingress traffic on port 80.. The exhibit shows that a firewall rule exists allowing ingress on port 80 only for instances with the network tag 'web-server'. The instance 'instance-1' does not have this tag, so the firewall rule does not apply to it. Therefore, traffic on port 80 is blocked by default, even if the web server is running.

Answer

The startup script failed because apt-get requires root privileges but the script runs as a non-root user.

Answer

The instance is preemptible and was terminated before the startup script completed.

Answer

The enable-oslogin metadata key set to 'false' prevents SSH access, but not web traffic.

Question 15

A company runs a batch job every night that processes large CSV files stored in Cloud Storage. The job runs on a single Compute Engine VM and takes 4 hours to complete. The team wants to reduce execution time without increasing cost substantially. The job is CPU-intensive and can be parallelized. What should they do?

Accepted Answer

Split the input files into smaller chunks and use multiple VMs in a managed instance group with a job scheduler.. Splitting the input files into smaller chunks and using multiple VMs in a managed instance group with a job scheduler effectively parallelizes the CPU-intensive batch job without significantly increasing cost. This approach leverages existing Compute Engine resources and scales horizontally using multiple smaller, cost-effective VMs. Option A (Dataproc with Spark) introduces managed service overhead and potential cluster costs, which may increase expenses. Option B (Cloud Batch) provides autoscaling but still requires the user to design parallelization and may not be as cost-efficient for this specific workload. Option C (using a VM with more vCPUs) increases cost due to vertical scaling and may not provide proportional performance gains. Thus, D is the most suitable choice.

Answer

Migrate the job to Dataproc and run it as a Spark job.

Answer

Use Cloud Batch to run the job as a batch job that automatically scales.

Answer

Use a VM with more vCPUs and a higher CPU platform.

Question 16

A company is deploying a critical application on GKE and needs to ensure high availability for the Kubernetes control plane and etcd data. Which TWO approaches should they implement? (Choose TWO.)

Accepted Answer

Use a regional GKE cluster with multiple zones. GKE automatically manages control plane availability with regional clusters. For etcd backups, using Velero is a standard approach. Increasing node size does not improve control plane availability. Manual control plane management is not needed in GKE. Single-zone clusters do not provide HA.

Answer

Manually manage the control plane on Compute Engine

Answer

Increase the machine type of the node pool

Answer

Use a single-zone cluster with a large node pool

Question 17

A company wants to monitor their Cloud Run services for errors and latency. Which Google Cloud product should they use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) provides comprehensive observability for Cloud Run services, including built-in dashboards for request latency, error rates, and resource utilization. It collects metrics like request count, request latencies, and container instance counts, and allows you to set alerting policies based on these metrics. While Cloud Trace can help with latency analysis and Cloud Logging captures logs, Cloud Monitoring is the primary product for monitoring both errors and latency in a unified view.

Answer

Cloud Trace

Answer

Cloud Logging

Answer

Error Reporting

Question 18

Your service has a 99.99% uptime SLO (monthly error budget ~ 4 minutes). Which TWO monitoring practices best support this SLO? (Choose 2)

Accepted Answer

Use a combination of availability (e.g., HTTP 200 rate) and latency (e.g., p99) as SLIs.. Options B and E are correct. A good SLI combines availability and latency into a single measure; the error budget approach is the standard way to manage SLOs. Option A is wrong: CPU alone is not a user-facing SLI. Option C is wrong: synthetic monitoring is useful but not alone sufficient; a combination of real and synthetic is recommended. Option D is wrong: alerting on every 5xx error can lead to alert fatigue; better to alert based on error budget burn rate.

Answer

Monitor CPU utilization and alert when average exceeds 80%.

Answer

Use only synthetic monitoring from multiple locations.

Answer

Alert on every 5xx error immediately.

Question 19

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before loading it into BigQuery. Which Google Cloud service should they use?

Accepted Answer

Cloud DLP. Cloud Data Loss Prevention (DLP) API can inspect data for PII and de-identify it using techniques like masking, tokenization, or bucketing.

Answer

Cloud Dataprep

Answer

Cloud Composer

Answer

Cloud Data Fusion

Question 20

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

Accepted Answer

Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'. The `iam.serviceAccount` condition attribute in IAM conditions allows you to restrict access based on the service account identity of the caller. When a Compute Engine instance uses a service account, the condition `iam.serviceAccount == "sa@project.iam.gserviceaccount.com"` ensures that only requests authenticated with that specific service account are allowed to access the Cloud Storage bucket. This is the standard IAM condition attribute for matching the service account of the requesting principal.

Answer

Condition: 'request.auth == "serviceAccount:sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'origin.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'resource.serviceAccount == "sa@project.iam.gserviceaccount.com"'