Google PCA Practice Exam 52 — 20 Questions

Question 1

A healthcare company stores sensitive patient data in Cloud Storage buckets. The company must ensure that data is encrypted at rest with keys that are automatically rotated every 90 days and that the keys are managed by the company itself, not by Google. The company also needs to maintain full control over key lifecycle and access policies. Which encryption option should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with a 90-day rotation schedule.. Customer-managed encryption keys (CMEK) in Cloud KMS allow the healthcare company to manage its own encryption keys, set a 90-day rotation schedule, and control access via IAM. This satisfies the requirements for encryption at rest, automatic key rotation, and full control over key lifecycle. Other options either do not provide self-management or lack automatic rotation.

Answer

Cloud External Key Manager (Cloud EKM) with keys stored in a third-party HSM.

Answer

Google-managed encryption keys (GMEK) with default encryption.

Answer

Customer-supplied encryption keys (CSEK) provided with each request.

Question 2

A healthcare company is deploying a new patient portal on Google Cloud. The portal must be accessible globally with low latency, must survive a single region failure, and must use a single anycast IP address. The backend runs on managed instance groups in two regions. Which Google Cloud product should the architect use to expose the service?

Accepted Answer

Global external HTTP(S) Load Balancing. Global external HTTP(S) Load Balancing is the only option that provides a single global anycast IP, edge termination, and automatic multi-region failover for HTTP(S) workloads. Regional proxies lack global anycast, Cloud DNS geo-routing introduces DNS caching delays and multiple IPs, and internal load balancing is not internet-facing. The chosen design satisfies global low latency and region-failure survivability.

Answer

Internal HTTP(S) Load Balancer with global access

Answer

Regional external TCP/SSL proxy load balancer

Answer

Cloud DNS with geo-routing and health checks

Question 3

A company needs to ensure that all data stored in Cloud Storage is encrypted at rest with keys that they control and can rotate on demand. They also need to maintain an audit trail of key usage. Which Google Cloud service should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) in Cloud KMS. Customer-managed encryption keys (CMEK) in Cloud KMS give the company full control over key creation, rotation, and usage. Cloud KMS integrates with Cloud Audit Logs to record all key operations, providing the required audit trail. Google-managed keys offer no customer control, CSEK lack integrated auditing, and Cloud HSM is a backing option for CMEK rather than a standalone solution.

Answer

Google-managed encryption keys

Answer

Customer-supplied encryption keys (CSEK)

Answer

Cloud HSM

Question 4

A financial services firm must design a data residency solution. Regulators require that customer personal data never leaves the country of origin, but the firm wants to use a single centralized analytics project for aggregated, non-personal reporting. Which Google Cloud architecture best satisfies both requirements?

Accepted Answer

Store personal data in regional Cloud Storage buckets and BigQuery datasets located only in the required country, and use VPC Service Controls perimeters to prevent data egress, while aggregating anonymized metrics into the central analytics project.. Data residency is about where bytes are physically stored and replicated, so the architecture must pin personal data to regionally scoped datasets and buckets in the required country and use VPC Service Controls to stop egress. Encryption keys and network topology do not constrain physical location. Only anonymized aggregates may cross into the central analytics project.

Answer

Deploy a Shared VPC host project spanning multiple regions and use firewall rules to restrict which regions instances can reach, keeping all data logically within one network.

Answer

Store all data in a multi-region Cloud Storage bucket and rely on customer-managed encryption keys to satisfy residency, aggregating data in the central project.

Answer

Use a global BigQuery dataset with column-level security and authorized views, then copy personal data into the central analytics project for processing.

Question 5

A logistics company runs a latency-sensitive inventory service on Compute Engine in us-central1. The service writes to a Cloud SQL for MySQL instance and reads from a Memorystore for Redis cache. The architect must design for a zone failure in us-central1 with minimal data loss and automatic failover, without changing the application's connection strings. Which design should the architect choose?

Accepted Answer

Deploy the service in a managed instance group across three zones, use a Cloud SQL for MySQL regional instance with a primary and standby, and configure Memorystore for Redis in Standard Tier with automatic failover.. Spreading the service across zones with a regional managed instance group, pairing it with a Cloud SQL regional instance that has a standby in another zone, and using Memorystore Standard Tier with automatic failover together address zone failure at every tier. Each component exposes stable endpoints, so the application keeps its existing connection strings.

Answer

Deploy the service in a multi-region managed instance group, use Cloud Spanner instead of Cloud SQL, and use Memorystore for Redis in Basic Tier.

Answer

Deploy the service across two zones, use a Cloud SQL for MySQL regional instance, and run a self-managed Redis cluster on Compute Engine with Sentinel.

Answer

Deploy the service in a zonal managed instance group, use a Cloud SQL for MySQL zonal instance, and enable Memorystore for Redis Basic Tier with read replicas.

Question 6

You are deploying a new version of a microservices application to a GKE cluster. The deployment must be released to a small subset of users first, and if errors occur, traffic must automatically revert to the previous version. You also need to monitor the error rate and latency of the new version. Which approach should you use?

Accepted Answer

Use Anthos Service Mesh to implement a canary deployment with traffic splitting, and configure automatic rollback based on error rate metrics.. Anthos Service Mesh offers advanced traffic management, including canary deployments with precise traffic splitting and automated rollback triggered by monitoring metrics. This aligns with the need to release to a subset, monitor, and revert automatically. The other options lack either the fine-grained traffic control or the automation required.

Answer

Create two separate GKE clusters, one for the old version and one for the new version, and use a global load balancer to split traffic 50/50. Monitor errors and manually shift traffic back if needed.

Answer

Deploy the new version as a separate Kubernetes Service and use an Ingress with session affinity to route a percentage of users to the new version. Monitor errors and adjust the Ingress configuration manually.

Answer

Use a Kubernetes Deployment with a rolling update and configure readiness probes; use kubectl rollout undo if errors occur.

Question 7

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that each microservice can only communicate with specific other microservices, and they need to enforce this at the network level. They also want to minimize operational overhead. Which approach should they use?

Accepted Answer

Use Kubernetes NetworkPolicies to define ingress and egress rules between pods.. Kubernetes NetworkPolicies are the native, low-overhead way to enforce pod-level network segmentation in GKE. They allow you to define which pods can communicate based on labels and namespaces, and they are enforced by the CNI plugin. This meets the requirement for fine-grained control with minimal operational effort compared to a service mesh or node-level firewall rules.

Answer

Configure VPC firewall rules to allow or deny traffic between GKE nodes.

Answer

Use Google Cloud Armor security policies to restrict traffic between services.

Answer

Implement a service mesh like Istio to manage service-to-service communication.

Question 8

A healthcare company runs a critical patient portal on Google Kubernetes Engine. The security team requires that all container images be scanned for vulnerabilities before deployment, that only images from a trusted registry be admitted to the cluster, and that any attempt to deploy an untrusted image be blocked and logged. Which Google Cloud feature should the cloud architect implement to enforce these admission requirements?

Accepted Answer

Binary Authorization with a policy that requires attestations from a trusted vulnerability scanner and allows only images from the approved registry, integrated with GKE admission control.. Binary Authorization is the GKE-native admission control that enforces policies at deploy time using attestations. A policy can require that images be attested by a trusted scanner and originate from an approved registry, and violations are denied and logged. Vulnerability scanning alone detects but does not block, network policies do not govern kubelet image pulls, and sandboxing hardens runtime without validating provenance.

Answer

GKE network policies that restrict egress from the cluster to only the trusted registry, preventing pods from pulling images from unapproved sources.

Answer

GKE Sandbox with gVisor runtime enabled on all node pools to isolate containers and reduce the impact of vulnerable images.

Answer

Artifact Registry vulnerability scanning with automatic scanning enabled on push for all repositories.

Question 9

A media company stores millions of video master files in a Cloud Storage bucket in the us-central1 region. Files are written once, accessed frequently for the first 30 days during editing and publishing, and then almost never accessed again, though they must remain retrievable for seven years. The company wants to minimize storage cost without changing the objects' names or the way applications read them. Which approach should the architect recommend?

Accepted Answer

Configure an Object Lifecycle Management rule on the bucket that transitions objects to Nearline Storage after 30 days and to Coldline Storage after 365 days. The access pattern is predictable: hot for 30 days, then cold for years. Object Lifecycle Management transitions objects between storage classes in place, so applications keep reading the same object names while the per-gigabyte cost drops as access frequency falls. Approaches that move objects to another bucket or change the default class either break read paths or fail to reclassify existing data.

Answer

Create a second bucket with the Coldline storage class and rewrite each object into it after 30 days using a scheduled job

Answer

Set the bucket's default storage class to Archive and enable Autoclass so objects are promoted on access

Answer

Keep objects in Standard storage and enable Turbo Replication to improve read performance across regions

Question 10

A healthcare company is planning to store sensitive patient records in Cloud Storage. They need to ensure that the data is encrypted at rest with keys that they control and can rotate on demand. They also want to maintain an audit trail of key usage. Which Google Cloud service should they use?

Accepted Answer

Cloud Key Management Service (Cloud KMS) with customer-managed encryption keys (CMEK).. Cloud KMS with customer-managed encryption keys gives the company full control over key creation, rotation, and usage. It integrates with Cloud Audit Logs to record key operations. The other options either do not provide customer control, lack auditability, or are not specific to the requirement.

Answer

Cloud HSM with a hardware security module for key storage.

Answer

Customer-supplied encryption keys (CSEK) stored on-premises.

Answer

Cloud Storage default encryption with Google-managed keys.

Question 11

A company is deploying a new application on Google Kubernetes Engine (GKE). They need to ensure that pods can only pull container images from a private Artifact Registry repository and that images are scanned for vulnerabilities before deployment. They also want to prevent pods from being scheduled if they use images from public registries. What should they do?

Accepted Answer

Use Binary Authorization with a policy that requires attestations from a vulnerability scanner, and configure the GKE cluster to only allow images from the private Artifact Registry.. Binary Authorization is the managed service for enforcing deploy-time policies on GKE, including requiring attestations from vulnerability scanners and restricting images to trusted registries. Configuring the cluster to only allow images from the private Artifact Registry ensures that public images cannot be used. Together, they meet the security requirements.

Answer

Enable Container Analysis API and use an admission controller to block images from public registries.

Answer

Configure a private GKE cluster and use network policies to block egress to public registries.

Answer

Use Anthos Config Management with a policy that denies pods using public images, and enable vulnerability scanning in Artifact Registry.

Question 12

A healthcare analytics firm processes patient records in a Dataflow streaming pipeline that writes enriched events to BigQuery. The pipeline currently uses a fixed number of workers sized for peak load, and utilization is low for most of the day. The team wants the pipeline to scale with incoming volume while keeping late-arriving events correct and bounded in cost. What should they do?

Accepted Answer

Enable autoscaling on the pipeline and set a windowing strategy with allowed lateness, using accumulation mode to emit updated results.. Autoscaling lets Dataflow add and remove workers as the backlog changes, removing the idle capacity of a peak-sized fixed pool. Windowing with allowed lateness and accumulation mode keeps late records correct by updating previously emitted results, so the pipeline scales with volume while bounded cost and data correctness are both preserved.

Answer

Convert the pipeline to batch mode and run it hourly with a Cloud Scheduler trigger, writing each batch to BigQuery.

Answer

Increase the number of workers permanently and enable disk-based shuffle to give the pipeline more headroom for late data.

Answer

Keep the fixed worker pool but switch the pipeline to use Streaming Engine and enable the Dataflow Shuffle service.

Question 13

A healthcare analytics company ingests HL7 messages into Pub/Sub and processes them with a Dataflow streaming pipeline that writes results to BigQuery. During a regional outage, the pipeline stopped and the team discovered that unacknowledged messages were lost after the retention window expired. The company needs a design where a single-region failure does not cause message loss and the pipeline can resume with minimal manual intervention. What should the architect recommend?

Accepted Answer

Deploy the Dataflow pipeline as a regional job in two regions with a Pub/Sub subscription in each, and configure the topic to store messages in a second region using message storage policy or a global endpoint.. The failure mode is losing messages when a single region is unavailable and the retention window closes. Keeping Pub/Sub message data in more than one region through a message storage policy or global endpoint, plus running the Dataflow job regionally in two locations each with its own subscription, gives both durability of the messages and a surviving processing path. Retention tuning, object storage substitution, and autoscaling do not remove the single-region dependency.

Answer

Increase the Pub/Sub message retention duration to the maximum and add a dead-letter topic so failed messages are preserved for later reprocessing.

Answer

Replace Pub/Sub with a Cloud Storage bucket in dual-region mode and have Dataflow read new objects with a streaming pipeline triggered by Eventarc notifications.

Answer

Run the Dataflow pipeline in a single region but enable autoscaling and set the maximum number of workers higher so it drains the backlog faster after an outage.

Question 14

A healthcare company stores patient records in Cloud Storage buckets across multiple projects. An audit reveals that several buckets containing protected health information are publicly accessible. The security team wants a centralized, automated way to detect and remediate public access across all current and future projects, with minimal operational effort. Which solution should the architect recommend?

Accepted Answer

Use Security Command Center with the built-in Cloud Storage public access finding and configure automated remediation via Cloud Functions.. Security Command Center provides centralized, organization-wide detection of publicly accessible Cloud Storage buckets through built-in findings. By routing findings to Pub/Sub and triggering Cloud Functions, the team can automatically remediate public access across all current and future projects. Organization policy constraints prevent new exposures but do not detect or fix existing ones, and legacy tools like Forseti are deprecated.

Answer

Deploy a Forseti Security instance to scan all projects and automatically remove public IAM bindings.

Answer

Create an organization policy constraint that disables public access on all Cloud Storage buckets.

Answer

Enable uniform bucket-level access on all buckets and rely on Cloud Audit Logs to detect public access.

Question 15

A financial services company needs to ensure that all outbound traffic from its Compute Engine instances to the internet goes through a dedicated IP address for allowlisting by a partner. The instances are in a private subnet with no external IP addresses. The company wants to minimize management overhead and avoid single points of failure. Which solution should the architect implement?

Accepted Answer

Configure a Cloud NAT gateway with a manual IP address allocation and attach it to the VPC network in the region where the instances reside.. Cloud NAT with manual IP allocation is the correct solution because it provides a managed, regional service that uses reserved external IP addresses for outbound traffic from private instances. It scales automatically, has no single point of failure, and requires minimal operational effort, directly satisfying the partner allowlisting requirement.

Answer

Assign external IP addresses to all instances and use Cloud DNS to map them to a single hostname for the partner.

Answer

Create a VPN tunnel to the partner's network and route all internet-bound traffic through the partner's gateway.

Answer

Deploy a third-party firewall appliance on a Compute Engine instance with an external IP and route all outbound traffic through it using a custom route.

Question 16

A healthcare company is migrating a legacy on-premises Oracle database to Google Cloud. The database is used for a patient records application that requires strong consistency, ACID transactions, and a relational schema with complex joins. The company wants a fully managed, highly available relational database service that minimizes administrative overhead while supporting their existing SQL workloads. Which Google Cloud service should they choose?

Accepted Answer

Cloud SQL for PostgreSQL. Cloud SQL for PostgreSQL is the best choice because it provides a fully managed relational database with ACID compliance, strong consistency, and support for complex SQL queries, matching the legacy Oracle workload's needs. It reduces operational burden with automated backups, replication, and high availability. Other options are either NoSQL databases lacking relational features or overly complex for the required scale.

Answer

Cloud Spanner

Answer

Bigtable

Answer

Firestore

Question 17

A financial services company runs a latency-sensitive trading application on GKE. The platform team must guarantee that the application can be recovered within a 15-minute recovery time objective (RTO) and a 5-minute recovery point objective (RPO) after a regional failure. They use a multi-region Cloud Storage bucket for configuration and a regional GKE cluster. Which additional design element is required to meet both objectives?

Accepted Answer

Deploy a second regional GKE cluster in another region and use a multi-region Cloud Storage bucket for shared configuration, with a documented failover runbook.. Meeting a 15-minute RTO and 5-minute RPO after a regional failure requires compute capacity and configuration data available outside the failed region. A standby GKE cluster in another region supplies the compute, while a multi-region Cloud Storage bucket keeps configuration accessible. A rehearsed failover runbook ensures the team can switch over quickly enough to satisfy the RTO.

Answer

Enable GKE cluster autoscaling and configure a horizontal pod autoscaler for the trading pods.

Answer

Configure the existing regional GKE cluster with a node pool in each of the three zones of its region and enable pod anti-affinity.

Answer

Use Anthos Config Management to sync configurations to the existing cluster and enable Binary Authorization for the trading images.

Question 18

A logistics company runs a latency-sensitive order-tracking service on Compute Engine instances spread across three zones in one region. They need the architecture to survive the loss of an entire zone while keeping inter-instance latency low, and they want automatic failover without manual intervention. Which design should the architects implement?

Accepted Answer

Deploy a managed instance group with regional distribution across the three zones, front it with a regional external Application Load Balancer, and configure health checks with autoscaling.. Spreading a regional managed instance group across three zones means a zone outage only removes a fraction of capacity, and health-checked load balancing automatically diverts traffic from failed instances and restores it on recovery. This delivers unattended, in-region failover with low latency, unlike single-zone groups, unmanaged instances, or global routing that can add distance.

Answer

Deploy a managed instance group in each of the three zones separately, and place a global external Application Load Balancer in front of all three groups.

Answer

Deploy standalone Compute Engine instances in each of the three zones with static external IPs and use DNS round-robin to distribute client traffic.

Answer

Deploy a managed instance group in a single zone, front it with a global external Application Load Balancer, and rely on the load balancer to fail over across regions.

Question 19

A multinational corporation needs to ensure that data stored in Cloud Storage buckets in their Google Cloud organization cannot be accessed from outside their corporate network, even if IAM policies are misconfigured. They want to enforce this at the organization level with minimal administrative overhead. What should they do?

Accepted Answer

Create a VPC Service Controls perimeter that includes the Cloud Storage service and the projects containing the buckets, and configure access levels to allow only corporate IP ranges.. VPC Service Controls provide a centralized, organization-level security perimeter that prevents access to Cloud Storage from outside authorized networks, even if IAM policies are misconfigured. By defining access levels based on corporate IP ranges, the organization can ensure that only requests from the corporate network are allowed. This is the most effective and least administrative approach compared to per-binding IAM Conditions or bucket-level constraints.

Answer

Enable Cloud Armor security policies on all Cloud Storage buckets to block external IPs.

Answer

Use IAM Conditions on all Cloud Storage IAM bindings to allow access only from corporate IP ranges.

Answer

Apply an organization policy constraint `storage.publicAccessPrevention` to all buckets.

Question 20

A healthcare company needs to run a stateful, containerized electronic medical records application that requires a stable network identity and persistent disk storage per replica. The operations team is already fluent with Kubernetes. Which Google Cloud service should they choose?

Accepted Answer

Google Kubernetes Engine with a StatefulSet. Stateful containerized workloads requiring stable identity and persistent storage per replica map directly to Kubernetes StatefulSets, and the team's existing Kubernetes skills make GKE the natural fit. Serverless container and function platforms abstract away the instance, so they cannot provide per-replica persistent disks or stable network identities.

Answer

Cloud Functions

Answer

App Engine flexible environment

Answer

Cloud Run