Google PCA Practice Exam 52 — 20 Questions

Question 1

A company wants to monitor the performance of their microservices deployed on Cloud Run. They need to capture request latencies and error rates, and also trace requests across services. Which TWO services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Trace. Cloud Monitoring collects metrics like latency and error rates and can create dashboards and alerts. Cloud Trace collects latency data across services for distributed tracing.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Logging

Question 2

Refer to the exhibit. A subnet was created with the `--enable-private-ip-google-access` flag. What does this flag enable for instances in this subnet?

Accepted Answer

Instances can access Google APIs and services without requiring an external IP address.. The `--enable-private-ip-google-access` flag allows VM instances in a subnet to reach Google APIs and services (such as Cloud Storage, BigQuery, and Cloud Pub/Sub) using only their internal (private) IP addresses, without needing an external IP address. This works by routing traffic through Google's internal network to the Google Front End (GFE), bypassing the public internet.

Answer

Instances can use direct peering to connect to on-premises networks.

Answer

Instances automatically receive internal DNS names for Google services.

Answer

Instances can route traffic to the internet through a Cloud NAT gateway.

Question 3

A security engineer is configuring VPC Service Controls to protect a project containing BigQuery datasets with PII. They want to prevent data exfiltration while allowing authorized users to query the data from outside the perimeter. Which configuration meets these requirements?

Accepted Answer

Create a perimeter that includes the project, and use an access level from Access Context Manager to grant access to authorized users.. VPC Service Controls use Access Context Manager (ACM) access levels to define granular, identity-based access conditions. By including the project in a perimeter and applying an access level that specifies authorized users (e.g., based on IP ranges, device state, or identity), you can allow those users to query BigQuery from outside the perimeter while blocking all other external traffic, preventing data exfiltration.

Answer

Create a perimeter that includes the project, and set the 'allowed external access' flag to true.

Answer

Create a perimeter and enable the 'exfiltration exception' for BigQuery.

Answer

Create a perimeter that includes only Compute Engine instances, and use a separate perimeter for BigQuery.

Question 4

Which THREE of the following are recommended practices when designing a highly available architecture on Google Cloud using multiple regions?

Accepted Answer

Use a global external HTTP(S) load balancer with backend services in multiple regions. A global external HTTP(S) load balancer uses Google's global anycast IP and routes traffic to the closest healthy backend in any region, enabling cross-region failover and low latency. It automatically handles failover between regions when health checks detect backend failures. Option C is correct because Cloud Spanner provides built-in synchronous replication across regions for strong consistency and high availability, while cross-region replication for databases like Cloud SQL ensures data redundancy and automated failover. Option D is correct because health checks detect instance or service failures, Cloud DNS with weighted routing allows traffic distribution across regions, and automated failover ensures that if one region becomes unhealthy, traffic is rerouted to healthy regions.

Answer

Deploy Compute Engine instances in a single regional managed instance group

Answer

Use a single Cloud VPN tunnel for connectivity between regions

Question 5

A company is using Cloud SQL for MySQL and wants to implement automated backups that are retained for 30 days. They also need point-in-time recovery. Which configuration should they use?

Accepted Answer

Enable automated backups with binary logging. Cloud SQL for MySQL requires automated backups to be enabled along with binary logging to support point-in-time recovery (PITR). Binary logs record all changes to the database, allowing you to restore to any specific timestamp within the backup retention period. Setting the retention to 30 days ensures backups are kept for the required duration, and binary logging enables the granular recovery needed for PITR.

Answer

Enable database replication

Answer

Use Cloud Storage versioning

Answer

Enable automated backups and set backup retention to 30

Question 6

A company uses the above IAM policy on a Cloud Storage bucket. They find that Bob can view objects in the bucket. Which statement explains this?

Accepted Answer

Bob is a member of the group viewers@example.com.. The IAM policy shown includes a binding that grants the `roles/storage.objectViewer` role to the group `viewers@example.com`. If Bob is a member of that group, he inherits the permissions to view objects in the bucket. The policy explicitly lists this group as a principal, so Bob's ability to view objects is directly explained by his group membership.

Answer

There is a higher-level policy that grants Bob viewer access.

Answer

The etag is mismatched causing policy override.

Answer

The bucket has uniform bucket-level access disabled.

Answer

The objectCreator role implicitly includes read access.

Question 7

A company has a Cloud Bigtable instance with 10 nodes. They notice read latency increases during peak hours. Monitoring shows CPU utilization at 70%. Which action will most effectively reduce read latency?

Accepted Answer

Increase the number of nodes. High CPU utilization (70%) indicates the cluster is stressed. Adding nodes increases throughput and reduces latency. SSDs are default, so not a factor. Row key redesign would require application changes. Table splitting is automatic.

Answer

Switch from HDD to SSD

Answer

Redesign row keys to avoid hotspots

Answer

Split the tables into more tablets

Question 8

A startup is setting up a CI/CD pipeline for their web application using Cloud Build and Cloud Deploy. They have configured a Cloud Build trigger that executes on pushes to the main branch of a Cloud Source Repositories repository. The trigger runs a build step that builds a Docker image and pushes it to Artifact Registry, then creates a release using Cloud Deploy. The pipeline fails with an error message indicating that the Cloud Build service account does not have permission to create releases. What should the architect do to resolve the issue?

Accepted Answer

Add the Cloud Deploy Developer IAM role to the Cloud Build service account.. The Cloud Build service account (typically the Compute Engine default service account or a custom service account) needs the Cloud Deploy Developer IAM role (roles/clouddeploy.developer) to create releases in Cloud Deploy. This role grants the necessary permissions, such as clouddeploy.releases.create, which are required for the Cloud Build trigger to successfully create a release after building and pushing the Docker image. Without this role, the pipeline fails with a permission error, making option A the correct resolution.

Answer

Verify that the cloudbuild.yaml file contains the correct steps.

Answer

Enable the Cloud Deploy API for the project.

Answer

Grant the Cloud Build service account the Cloud Run Admin role.

Question 9

A user runs the gsutil command shown in the exhibit and gets an AccessDenied error. The user is not authenticated with gcloud. What should the user do first?

Accepted Answer

Run gcloud auth login to authenticate with their Google account.. The error occurs because the user is not authenticated with gcloud. The gsutil command requires valid authentication credentials to access Google Cloud Storage resources. Running `gcloud auth login` initiates the OAuth 2.0 flow, which authenticates the user with their Google account and generates the access token that gsutil uses for API calls. This is the prerequisite step before any gsutil operation can succeed.

Answer

Create a service account and download a JSON key.

Answer

Grant public write access to the bucket.

Answer

Use gcloud config set project my-project to set the project.

Question 10

Which THREE services can be used to audit changes to resources in a Google Cloud project?

Accepted Answer

Security Command Center. Security Command Center (A) is correct because it provides a centralized view of security risks, including audit capabilities for resource changes via its 'Event Threat Detection' and 'Asset Inventory' features, which log and alert on modifications to Google Cloud resources. It integrates with Cloud Audit Logs to surface security-relevant changes, making it a valid service for auditing changes.

Answer

Cloud Monitoring

Answer

Cloud Endpoints

Question 11

After a production incident, a team wants to conduct a postmortem to identify root causes and document actions to prevent recurrence. Which steps are part of Google's recommended postmortem process?

Question 12

You are responsible for post-incident reviews. After a major outage, your team identifies that the root cause was a misconfiguration in a deployment pipeline that caused an incorrect rollout. Which step should be included in the postmortem process?

Accepted Answer

Define action items to prevent recurrence and improve detection. Postmortems should identify root cause, document timeline, and define action items to prevent recurrence. Blaming individuals is counterproductive. Only documenting the timeline is insufficient. Ignoring is not acceptable.

Answer

Ignore the incident and move on

Answer

Document the timeline of events and the root cause

Answer

Assign blame to the engineer who made the mistake

Question 13

A company has a fleet of Compute Engine instances that need to access a Cloud Storage bucket. The security team requires that only instances in specific VPC networks can access the bucket, and that the data is encrypted in transit. How can this be achieved?

Accepted Answer

Create a VPC Service Controls perimeter with access levels, and require HTTPS for the bucket.. VPC Service Controls allows you to define a security perimeter around Cloud Storage, restricting access to only requests originating from specific VPC networks. By configuring an access level that requires HTTPS, you enforce encryption in transit, meeting both the network restriction and data-in-transit encryption requirements.

Answer

Use a Cloud Storage bucket with encryption at rest using CSEK.

Answer

Use Cloud Armor with IP allowlists and enable TLS for the bucket.

Answer

Use a Cloud Storage bucket with encryption at rest using CMEK.

Question 14

Refer to the exhibit. A security team wants to ensure that the service account 'sa-compute' can only be used by the instance admin role. Currently, any user with 'iam.serviceAccountUser' on the project can impersonate it. Which change should be made to the policy?

Accepted Answer

Remove the 'roles/iam.serviceAccountUser' binding from the project policy and add a resource-level policy on the service account granting 'roles/iam.serviceAccountUser' only to 'developer@example.com'.. The exhibit shows a project-level IAM policy. The service account 'sa-compute' is granted 'roles/iam.serviceAccountUser' at the project level, meaning any user with that role on the project can impersonate it. To restrict usage, the policy should grant 'roles/iam.serviceAccountUser' on the service account itself to only specific users, not at the project level. The correct approach is to remove the project-level binding and add a resource-level policy on the service account.

Answer

Add a condition to the 'roles/iam.serviceAccountUser' binding that restricts access to only the instance admin.

Answer

Modify the project policy to change the 'roles/iam.serviceAccountUser' member to 'user:developer@example.com'.

Answer

Create a new custom role that combines 'roles/compute.instanceAdmin.v1' and 'roles/iam.serviceAccountUser' and assign it to 'developer@example.com'.

Question 15

A global application uses Cloud Spanner with a multi-region configuration. During a regional outage, some transactions are failing. What is the recommended approach to maintain write availability?

Accepted Answer

Configure Spanner with leader-based replication and rely on automatic failover. Cloud Spanner's multi-region configuration uses leader-based replication, where each region has a leader for its read-write replicas. During a regional outage, Spanner automatically fails over the leader to another region, ensuring write availability without manual intervention. This is the recommended approach because it leverages Spanner's built-in synchronous replication and automatic failover to maintain consistency and availability.

Answer

Implement application-level retry with exponential backoff

Answer

Use a single-region Spanner instance with a standby in a different zone

Answer

Manually failover to a different region using a script

Question 16

A company is performing a TCO analysis to compare on-premises costs with Google Cloud. Which cost should they include as a hidden operational cost on-premises?

Accepted Answer

Power, cooling, and physical security. On-premises hidden costs include facility costs (power, cooling, space), hardware maintenance, personnel for patching and upgrades. Egress costs are cloud costs, not on-prem. Compute Engine instance cost is a direct cloud cost. Software licenses depend on licensing model.

Answer

Compute Engine instance costs

Answer

Egress charges

Answer

Software license costs

Question 17

A company is migrating a critical database to Cloud SQL for MySQL. Which TWO actions ensure high availability?

Accepted Answer

Enable automatic backups.. Enabling automatic backups in Cloud SQL for MySQL ensures that point-in-time recovery (PITR) and daily backups are automatically taken, which is a fundamental requirement for high availability. While backups alone do not provide instant failover, they are essential for data durability and recovery in case of a disaster, and the question asks for actions that 'ensure high availability'—backups are a core component of a high-availability strategy by enabling recovery from data loss or corruption.

Answer

Use read replicas in multiple zones.

Answer

Configure a failover replica with a different IP.

Answer

Enable multi-region failover.

Question 18

A startup wants to grant a contractor limited access to a single Cloud Storage bucket. The contractor should be able to view and download objects, but not delete or overwrite them. Which IAM role should be assigned?

Accepted Answer

roles/storage.objectViewer. The roles/storage.objectViewer role grants read-only access to objects in a bucket, including listing and downloading objects, but does not allow modification or deletion.

Answer

roles/storage.admin

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectCreator

Question 19

A company runs a customer-facing web application on Google Kubernetes Engine (GKE) in us-central1. The application uses a Cloud SQL for PostgreSQL database for user data. Recently, they noticed that during peak hours, the application response times increase significantly, and some requests time out. The team has already scaled the GKE nodepool to the maximum size, but the issue persists. Database CPU utilization is at 80%, and connections are near the max limit. The application uses connection pooling via PgBouncer running as a sidecar. The team suspects the database is the bottleneck. They need to improve performance with minimal cost impact. What should they do?

Accepted Answer

Add read replicas and split read/write traffic.. Adding read replicas and splitting read/write traffic offloads read queries from the primary Cloud SQL instance, reducing CPU and connection pressure. PgBouncer as a sidecar can be configured to route read-only transactions to replicas, while writes go to the primary. This directly addresses the 80% CPU and max connections issue without increasing costs as much as scaling up the machine type.

Answer

Enable Cloud SQL automatic storage increase.

Answer

Increase the max connections parameter on Cloud SQL.

Answer

Increase the Cloud SQL machine type to the next tier.

Question 20

What is the effective access of the service account sa@project.iam.gserviceaccount.com to the bucket?

Accepted Answer

Full admin access to objects. The service account sa@project.iam.gserviceaccount.com is a Google Cloud IAM service account. When it is granted the 'Storage Admin' role (roles/storage.admin) at the project level, it gains full admin access to all buckets in the project, including the ability to create, delete, and manage objects. This role provides full control over objects, equivalent to 'Full admin access to objects'.

Answer

Owner access

Answer

Read-only access

Answer

No access