Google PCA Practice Exam 53 — 20 Questions

Question 1

A small development team is deploying a stateless containerized API on Google Cloud. They want the simplest possible way to run containers without managing servers or Kubernetes clusters, and they want the service to scale to zero when there is no traffic to minimize cost. The API receives HTTP requests from external clients. Which Google Cloud service should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Run with a container image deployed from Artifact Registry.. Cloud Run is a fully managed serverless platform for containers. It accepts container images from Artifact Registry, provides an HTTPS endpoint for external clients, and scales instances automatically, including down to zero when idle. This eliminates server and cluster management and directly addresses the cost-minimization goal. It is the simplest fit among the options for a stateless containerized HTTP API.

Answer

Google Kubernetes Engine (GKE) Autopilot with a Horizontal Pod Autoscaler.

Answer

Compute Engine managed instance groups with an autoscaler and an external HTTP(S) load balancer.

Answer

App Engine standard environment with a custom runtime.

Question 2

A media company stores millions of small image files in a Cloud Storage bucket in the us-central1 region. Users in Europe and Asia report slow image load times. The company wants to improve read latency globally while keeping write operations in us-central1 for cost and simplicity. Which storage configuration should you recommend?

Accepted Answer

Keep the regional bucket in us-central1 and enable Cloud CDN on an external Application Load Balancer serving the images.. Cloud CDN caches content at Google's globally distributed edge points of presence, so readers in Europe and Asia are served from nearby locations while the authoritative data stays in the us-central1 regional bucket. Writes remain simple and centralized. Changing the bucket to a multi-region or dual-region location does not cover all three continents, and moving the origin to Asia violates the write-location requirement.

Answer

Change the bucket to a multi-region location such as US and enable Turbo Replication.

Answer

Move the images to a bucket in the asia-southeast1 region and use a global external Application Load Balancer to route users.

Answer

Recreate the bucket as a dual-region bucket with us-central1 and europe-west1, then serve images directly from the bucket.

Question 3

A financial services firm is designing the network for a new payment processing platform on Google Cloud. Regulatory rules require that no workload can reach the public internet, that all egress to an on-premises fraud-detection system stay off the public internet, and that Google APIs such as Cloud Storage and BigQuery remain reachable without exposing the workloads. The platform runs on Compute Engine VMs in a single VPC. Which two design elements must the architect include? (Choose two.)

Accepted Answer

Create the subnet with the --enable-private-ip-google-access option so the VMs can reach Google APIs and services without external IP addresses.. Two independent constraints must be satisfied: Google APIs stay reachable while workloads have no public addresses, and on-premises traffic stays off the internet. Private Google Access on the subnet handles the first by routing API traffic internally, and a Cloud VPN or Interconnect link with Cloud Router BGP handles the second by providing private connectivity to the fraud-detection system. Cloud NAT, external IPs, and proxy VMs all push traffic onto the public internet.

Answer

Configure a Cloud NAT gateway with a manual IP address allocation on the VPC so the VMs can reach the fraud-detection system.

Answer

Deploy a Squid proxy on a VM with an external IP and route all VPC egress through it using a custom route with the proxy as the next hop.

Answer

Assign ephemeral external IP addresses to the VMs and protect them with a firewall rule that allows only the fraud-detection system's source range.

Question 4

A company is migrating an on-premises application to Google Cloud. The application consists of a web front end and a backend that uses a relational database. The company wants to minimize downtime during the migration and ensure that the database remains consistent. They plan to use a phased approach. Which TWO steps should they take to achieve a successful migration? (Choose two.)

Accepted Answer

Use Database Migration Service to continuously replicate data from the on-premises database to a Cloud SQL instance, then perform a cutover.. Establishing a secure network connection and using Database Migration Service for continuous replication are critical for a low-downtime migration. The network connection enables data transfer, and Database Migration Service keeps the target in sync until cutover. These steps ensure minimal downtime and data consistency, unlike manual export/import or unrelated scaling measures.

Answer

Configure Cloud SQL read replicas in multiple regions to ensure high availability and offload read traffic.

Answer

Deploy the web front end on Compute Engine instances and use a managed instance group with autoscaling to handle traffic.

Answer

Export the on-premises database to a CSV file, upload it to Cloud Storage, and import it into Cloud SQL during a maintenance window.

Question 5

A healthcare company stores PHI in BigQuery. Compliance requires that analysts see masked values for patient names and MRNs, while a small data-engineering group must see unmasked values for pipeline troubleshooting. The policy must be enforced by BigQuery itself, independent of any application code. Which approach should the architect implement?

Accepted Answer

Use BigQuery column-level security with policy tags in Data Catalog, granting the data-engineering group the Fine-Grained Reader role on the sensitive tags. BigQuery column-level security with Data Catalog policy tags enforces per-column access in the query engine. Sensitive columns are tagged, and only principals granted the Fine-Grained Reader role on that tag can read raw values. Analysts without the role receive masked or denied results, and engineers with the role see clear text, with no application changes needed.

Answer

Create two separate datasets and grant analysts access only to the masked dataset, applying a view that selects hashed columns

Answer

Enable VPC Service Controls around the BigQuery project so only the data-engineering group can query the dataset

Answer

Apply row-level security filters on the table so analysts only see rows belonging to their region

Question 6

An IoT company ingests telemetry from 40,000 devices spread across three continents. The architecture team wants a single logical endpoint that automatically routes each device's writes to the nearest healthy Google Cloud region, and they want to avoid managing per-region DNS records or load-balancer IPs. Which design should the architect choose?

Accepted Answer

A global external proxy Network Load Balancer with a single anycast IP and a TCP proxy target proxy. The requirement is one logical anycast endpoint that terminates arbitrary TCP and picks the nearest healthy region. A global external proxy Network Load Balancer does exactly that, with SSL or TCP proxy target proxies and health-checked regional backends. Application Load Balancers are HTTP(S)-only, DNS geolocation needs per-region records, and Interconnect plus an internal passthrough load balancer cannot accept public device traffic.

Answer

A global external Application Load Balancer with a single anycast IP fronting regional backends

Answer

Cloud Interconnect attachments from each continent into a single regional VPC with a regional internal passthrough Network Load Balancer

Answer

Cloud DNS with a geolocation routing policy pointing to regional external passthrough Network Load Balancer IPs

Question 7

A media company stores finished video masters in a Cloud Storage bucket. Legal requires that every object be retained for exactly seven years and that no user, including project owners, be able to delete or overwrite an object before that period ends. Which bucket configuration should the architect apply?

Accepted Answer

Apply a bucket lock with a retention policy of seven years and grant users the Storage Object Creator role.. Immutability for a fixed period is delivered by a bucket retention policy, and locking the bucket makes that policy irreversible so no principal can shorten it or delete protected objects early. Seven years expressed as a retention duration plus restricted write access satisfies the legal hold while still permitting new masters to be uploaded to the bucket.

Answer

Enable Uniform Bucket-Level Access and grant the Storage Object Admin role only to the security team.

Answer

Enable Object Versioning on the bucket and grant users only the Storage Object Viewer role.

Answer

Configure a lifecycle rule that moves objects to Archive storage after 30 days and deletes them after 2,555 days.

Question 8

A media company streams video from a global user base. The architect must provision a load balancer that terminates TLS, routes requests by URL path to different backend services, and provides a single global anycast IP address. The backend services run on managed instance groups in three regions. Which Google Cloud load balancer should the architect deploy?

Accepted Answer

Global external Application Load Balancer. A single global anycast IP, edge TLS termination, and URL path routing to backends in three regions all point to the global external Application Load Balancer. Its layer 7 proxy architecture inspects HTTP requests and uses URL maps to direct traffic, while the Google front end absorbs TLS and distributes requests across regional managed instance groups without requiring a separate IP per region.

Answer

External passthrough Network Load Balancer

Answer

Regional external Application Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 9

A logistics company is planning a new order-tracking platform on Google Cloud. The platform must handle sudden, unpredictable spikes from holiday promotions, keep costs low during idle periods, and provide a relational store that scales reads without the team managing replication. The architect is choosing between fully managed services and self-managed alternatives. Which two design choices meet these requirements? (Choose two.)

Accepted Answer

Use Cloud Spanner with a regional instance configuration, which scales reads and writes horizontally and replicates automatically.. Cloud Run scales to zero and then out automatically, which matches unpredictable promotional spikes while keeping idle cost near zero. Cloud Spanner provides a managed relational store that scales reads and writes horizontally with automatic replication, so the team never manages replicas or failover. Together they cover the compute and data tiers without the operational overhead of self-managed alternatives.

Answer

Deploy the API tier on a Compute Engine managed instance group with a fixed size sized for peak holiday traffic.

Answer

Run PostgreSQL on Compute Engine with streaming replication to a standby VM, and use a load balancer to split reads.

Answer

Use Cloud SQL for PostgreSQL with read replicas, and have the team script replica promotion for failover.

Question 10

A team is adopting a DevOps model and wants to reduce the risk of configuration drift between environments. They deploy the same application to development, staging, and production projects on Google Cloud. Which practice should they adopt to ensure consistent, repeatable deployments across all environments?

Accepted Answer

Define infrastructure as code using Terraform with separate variable files per environment, and store the configuration in a version control system.. Repeatable deployments across environments require a declarative, versioned definition of infrastructure. Terraform with per-environment variable files lets one set of modules produce consistent resources in development, staging, and production, while version control records changes and enables review and rollback. This prevents configuration drift far more effectively than manual changes or post-hoc detection.

Answer

Manually apply changes in each project and record them in a shared spreadsheet for audit purposes.

Answer

Use Cloud Console to configure each project and rely on Cloud Asset Inventory to detect differences after deployment.

Answer

Grant all engineers Owner role on each project so they can quickly recreate resources when drift is detected.

Question 11

A healthcare analytics company must build a data platform on Google Cloud that stores patient records subject to strict privacy rules. The design must ensure that analysts can query aggregated data without being able to read individual patient identifiers, and that all access to the raw records is logged for audit. Which two design choices should the architect include? (Choose two.)

Accepted Answer

Use Sensitive Data Protection (Cloud DLP) to de-identify or tokenize patient identifiers before loading records into the analytics dataset.. The two goals are preventing analysts from reading identifiers and logging all access to raw records. De-identifying or tokenizing identifiers before the analytics layer sees them meets the first goal, and enabling Data Access audit logs on the services holding raw records meets the second. Broad viewer grants, generic storage protections, and encryption alone do not de-identify data or provide the necessary read-level audit trail.

Answer

Store raw records in a Cloud Storage bucket with uniform bucket-level access and rely on object versioning for protection.

Answer

Encrypt the raw records with customer-managed encryption keys in Cloud KMS and rotate the keys every 90 days.

Answer

Grant all analysts the BigQuery Data Viewer role at the project level so they can explore datasets efficiently.

Question 12

A healthcare analytics company ingests continuous streams of device telemetry that must be processed in near real time, enriched with reference data from a Cloud SQL for MySQL instance, and written into BigQuery for analyst queries. The team wants minimal operational overhead and wants to use managed Google Cloud services. Which combination should the architect select?

Accepted Answer

Pub/Sub for ingestion, Dataflow for stream processing and enrichment, BigQuery for storage and analytics. The pipeline needs durable stream ingestion, managed stream processing with enrichment, and a warehouse for analyst SQL. Pub/Sub absorbs bursts and decouples producers, Dataflow handles autoscaling stream transforms and joins, and BigQuery stores and queries the results. Alternatives either require cluster management, cannot run analytics at scale, or use services not intended for continuous streaming.

Answer

Cloud Tasks for ingestion, Cloud Functions for processing, Cloud SQL for storage and analytics

Answer

Pub/Sub for ingestion, Dataproc with Spark Streaming for processing, Cloud Storage for storage and analytics

Answer

Pub/Sub for ingestion, Dataflow for stream processing, Bigtable for storage and analytics

Question 13

A healthcare company runs a multi-tenant SaaS platform on Google Cloud. Each tenant has a dedicated folder inside a single organization, with projects for each environment. A recent audit found that a compromised service account in one tenant's dev project could enumerate and read Cloud Storage buckets belonging to other tenants because the service account had been granted roles/storage.admin at the organization level by mistake. The security team wants a preventive control that blocks any future IAM binding that grants a role to a principal at a scope broader than a single project, unless the principal is part of a small break-glass group. They also want the control to apply automatically to all new projects. What should the architect implement?

Accepted Answer

Configure an organization policy using a custom constraint on the iam.googleapis.com/AllowPolicy resource, denying bindings where the resource scope is the organization or a folder unless the principal is in the break-glass group.. The requirement is a preventive, hierarchy-wide guardrail against overly broad IAM grants. Custom organization policy constraints on the IAM allow policy resource can inspect both the binding's scope and the principal, so a rule that denies organization- and folder-level grants except for a designated break-glass group enforces least privilege automatically for existing and new projects. Domain-based and condition-based approaches either do not address scope breadth or rely on per-binding correctness, so they would not have prevented the audit finding.

Answer

Create an organization policy with the iam.allowedPolicyMemberDomains constraint set to the company's Cloud Identity domain, and apply it to the organization node.

Answer

Enable IAM Conditions on all role bindings and require a condition that the resource name matches the tenant's folder path.

Answer

Create an organization policy with the iam.disablePolicyMemberDomainCheck constraint and apply it to the organization node.

Question 14

A media startup wants to give its data science team isolated environments for experimentation while keeping billing and user management under one organization. Each environment must have its own quotas and IAM boundary, and the team wants to add or remove environments quickly without renegotiating billing. Which Google Cloud resource hierarchy construct should the architect use for each environment?

Accepted Answer

A folder under the organization, with one project per environment and IAM policies inherited from the folder.. Folders sit between the organization and projects and let administrators apply IAM and organization policies that projects inherit, giving each environment a consistent administrative boundary. Each project supplies its own quotas, APIs, and resource namespace, so experiments stay isolated. Because everything remains inside one organization and billing account, environments can be spun up or torn down quickly without touching billing or identity setup.

Answer

A single project with separate VPC networks and firewall rules for each environment.

Answer

A separate Google Cloud organization for each environment, each linked to its own billing account.

Answer

A standalone project not attached to the organization, with billing enabled directly on the project.

Question 15

You are designing a solution to store and serve static web content for a global audience. The content consists of HTML, CSS, JavaScript, and images. You need to ensure low latency and high availability. Which Google Cloud service should you use?

Accepted Answer

Cloud Storage with a multi-region bucket and Cloud CDN.. Cloud Storage with a multi-region bucket provides durable, highly available storage, and Cloud CDN caches content globally to reduce latency. This is the simplest and most cost-effective solution for static web content. The other options involve unnecessary compute resources or management overhead.

Answer

Compute Engine instances in multiple regions behind a global load balancer.

Answer

Cloud Run services deployed in multiple regions with a global load balancer.

Answer

App Engine standard environment with a custom domain and Cloud CDN.

Question 16

A healthcare company runs a regulated patient-portal application on Google Cloud. Auditors require evidence that infrastructure changes are reviewed before they reach production and that production access is limited. The platform team currently applies Terraform changes directly from engineer laptops using personal credentials. Which two practices should the team adopt to satisfy the auditors while keeping delivery efficient? (Choose two.)

Accepted Answer

Store Terraform state in a Cloud Storage bucket with versioning and Object Versioning enabled, and grant write access only to the CI/CD service account.. Auditors want a controlled, reviewable path to production and a clear record of who deployed what. Running plan in CI on pull requests with mandatory peer review, then applying from an approved branch with a dedicated service account, creates that path. Backing it with a locked-down, versioned remote state bucket prevents out-of-band changes and preserves history. Together these practices keep delivery automated while producing the evidence and access controls the auditors require.

Answer

Disable Cloud Audit Logs for Terraform-related API calls to reduce log volume and cost.

Answer

Grant all platform engineers the Project Editor role so they can resolve production incidents quickly without approval delays.

Answer

Run terraform apply from each engineer's laptop but require them to commit the plan output to Git afterward.

Question 17

A company runs a three-tier web application on Compute Engine. The database tier must be reachable only from the application tier, and the application tier must be reachable from the web tier on TCP port 8080. The company wants to enforce these requirements at the network level with minimal administrative overhead and without relying on instance-level firewall software. What should they do?

Accepted Answer

Create a VPC firewall rule that allows TCP port 8080 from the web tier's network tag to the application tier's network tag, and another rule that allows the database port from the application tier's network tag to the database tier's network tag.. Tag-based VPC firewall rules are the standard way to enforce tier-to-tier access on Compute Engine. By allowing only TCP 8080 from the web tier tag to the application tier tag, and only the database port from the application tier tag to the database tier tag, the company implements least-privilege network segmentation centrally. This avoids instance-level firewall software and keeps administration simple.

Answer

Place the database tier in a separate VPC and use VPC Network Peering to connect it to the application tier's VPC, then allow all traffic between the peered networks.

Answer

Configure each instance with iptables rules that permit only the required traffic, and disable VPC firewall rules for the project.

Answer

Create a single VPC firewall rule that allows all TCP traffic between all instances in the VPC, and rely on the application code to restrict access.

Question 18

A financial services company runs a latency-sensitive trading application on Compute Engine. The operations team needs to detect performance regressions and correlate them with recent deployments without instrumenting application code. They want to use Cloud Monitoring and Cloud Logging features that work automatically for Compute Engine VMs. (Choose two.)

Accepted Answer

Create log-based metrics in Cloud Logging from VM logs and chart them alongside metrics in Cloud Monitoring dashboards.. The Ops Agent provides automatic host metrics and log collection for Compute Engine, and log-based metrics let those logs be charted and alerted in Cloud Monitoring. Together they deliver the telemetry to detect performance regressions and correlate them with deployments without touching application code. Tracing, profiling, and audit logs either require code changes or capture different data than runtime performance.

Answer

Install the Cloud Profiler agent on each VM to capture CPU and memory profiles of the application.

Answer

Enable Data Access audit logs for Compute Engine and analyze them to identify slow API calls.

Answer

Enable Cloud Trace auto-instrumentation by setting the GOOGLE_CLOUD_TRACE environment variable on each VM.

Question 19

A retail company runs its order-processing system on Google Kubernetes Engine (GKE). The operations team wants to improve the reliability and cost efficiency of the cluster. They observe that several workloads have no resource requests or limits set, and some nodes are consistently underutilised while others are overcommitted. Which two actions should the architect recommend to address these issues? (Choose two.)

Accepted Answer

Configure resource requests and limits for all pods based on observed usage.. The core problems are inaccurate resource signalling and static node capacity. Defining requests and limits lets the scheduler place pods correctly and enables autoscaling features to work effectively. Enabling the cluster autoscaler then adjusts node pool size to match actual demand, adding capacity when pods are pending and removing idle nodes. Together they improve reliability during peaks and reduce cost during low usage.

Answer

Disable the horizontal pod autoscaler to avoid fluctuating replica counts.

Answer

Migrate all workloads to a single, larger node pool with no autoscaling.

Answer

Set the pod disruption budget for all deployments to zero.

Question 20

A healthcare analytics company runs a stateless API on a regional managed instance group behind an external Application Load Balancer. The SRE team wants to improve reliability and reduce customer-visible errors during zonal and instance failures. (Choose two.)

Accepted Answer

Configure the load balancer's backend service with a health check that matches the API's readiness endpoint and set a sensible unhealthy threshold.. Autoscaling lets the regional managed instance group add or maintain capacity so healthy instances in surviving zones can handle traffic when one zone or instance fails. A health check aligned to the API's readiness endpoint ensures the load balancer routes only to instances that can actually serve requests, cutting customer-visible errors. Together they address zonal and instance failure reliability.

Answer

Set the load balancer's balancing mode to RATE and configure a maximum rate per instance to cap traffic.

Answer

Create a second managed instance group in a different region and add it as a backend to the same load balancer.

Answer

Enable Cloud CDN on the backend service to cache API responses and reduce origin load.