Google PCA Practice Exam 53 — 20 Questions

Question 1

A company wants to connect their on-premises data center to Google Cloud with a dedicated, low-latency, and highly available connection. They need bandwidth of 10 Gbps. Which option should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dedicated Cloud Interconnect. Dedicated Cloud Interconnect provides direct physical connections between on-premises and Google's network with speeds up to 100 Gbps per link. It offers high availability and low latency. HA VPN is over the public internet, Partner Interconnect depends on a partner, and Classic VPN is older.

Answer

Classic VPN

Answer

HA VPN over the public internet

Answer

Partner Cloud Interconnect

Question 2

A company wants to optimize their cloud spending on Google Cloud. They have a mix of workloads including batch processing, real-time analytics, and web serving. Which TWO strategies should they implement to reduce costs without significant architectural changes? (Choose two.)

Accepted Answer

Use preemptible VMs for batch processing jobs that are fault-tolerant.. Preemptible VMs are short-lived, fault-tolerant instances that cost significantly less than standard VMs, making them ideal for batch processing jobs that can handle interruptions. This strategy directly reduces compute costs without requiring architectural changes, as the workloads are already designed to be resilient to failures.

Answer

Use sustained use discounts for short-lived instances.

Answer

Right-size all Compute Engine instances by analyzing utilization metrics.

Answer

Migrate all web serving workloads to Cloud Functions to benefit from pay-per-use pricing.

Question 3

A company deploys a web application on Compute Engine behind a Global HTTPS Load Balancer. They need to restrict access to the application based on the client's IP address. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides IP-based access control at the edge of Google's network, integrated directly with the Global HTTPS Load Balancer. It allows you to create security policies with IP allow/deny rules that are evaluated before traffic reaches your Compute Engine instances, making it the appropriate service for client IP restriction at the load balancer level.

Answer

VPC firewall rules

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Question 4

A developer wants to run a stateless HTTP API that automatically scales based on incoming request traffic. The API is packaged as a Docker container. They want to minimize operational overhead and only pay for resources when the API is handling requests. Which service should they use?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that automatically scales, including scaling to zero, and bills per request. GKE requires cluster management. Compute Engine requires VM management. App Engine Standard does not support custom containers.

Answer

App Engine Standard

Answer

Google Kubernetes Engine (GKE) Autopilot

Answer

Compute Engine with managed instance groups

Question 5

Which THREE are required to configure Workload Identity for a GKE cluster? (Choose 3)

Accepted Answer

Create a Google Cloud service account. A Google Cloud service account (GSA) is required to authenticate to Google Cloud APIs from within GKE. Workload Identity maps a Kubernetes service account (KSA) to a GSA, allowing pods to inherit the GSA's IAM permissions without managing static keys. The GSA must be created first to define the identity that workloads will assume.

Answer

Bind the Kubernetes service account to the Google Cloud service account using a Kubernetes RoleBinding

Answer

Use a node pool that has Workload Identity enabled

Question 6

A company is migrating 100 TB of on-premises file shares to Cloud Storage. The network bandwidth is limited to 100 Mbps and the migration must complete within 2 weeks. Which TWO services should they consider? (Choose 2)

Accepted Answer

Transfer Appliance. Transfer Appliance is ideal for large data volumes with limited bandwidth as it physically ships the data. Storage Transfer Service can handle the final synchronization from a temporary staging location. Migrate for Compute Engine is for VM migration, not file data.

Answer

Migrate for Compute Engine

Answer

BigQuery Data Transfer Service

Answer

gsutil cp command with parallel processing

Question 7

A company uses Cloud Spanner for a global financial application. They experience increased latency and transaction aborts during peak hours. Which measure should they take first to improve reliability?

Accepted Answer

Optimize transactions to reduce lock contention.. Transaction aborts and latency in Cloud Spanner are most commonly caused by lock contention during peak hours. By optimizing transactions—such as reducing their scope, using read-only transactions where possible, and avoiding hot-spot writes—you directly address the root cause of contention without incurring additional cost or schema changes. This aligns with Google's best practices for Spanner reliability.

Answer

Increase the number of nodes in the Spanner instance.

Answer

Reduce the number of indexes on frequently updated columns.

Answer

Use interleaved tables to co-locate related data.

Question 8

After deploying the above configuration, the application is not receiving traffic from the Kubernetes Service. The Service is correctly configured to target port 8080. What is the most likely issue?

Accepted Answer

The readiness probe is using HTTP but the container may not be ready on that path; change to TCP.. The readiness probe is configured as an HTTP GET request, but the application container may not be serving traffic on the specified HTTP path at startup. If the application listens on a TCP port but does not respond to HTTP GET on that path, the readiness probe will fail, causing the Service to not route traffic to the Pod. Changing the readiness probe to a TCP socket check ensures the probe only verifies that the port is open, which is more reliable when the application does not expose an HTTP endpoint for health checks.

Answer

The initialDelaySeconds for readiness probe is too short; increase it.

Answer

The port name is not defined; add a name to the container port.

Answer

The image pull policy is not set to Always; new pods may use stale image.

Answer

The liveness probe uses tcpSocket; it should be HTTPGet.

Question 9

A firewall rule is configured to allow inbound TCP traffic on ports 80 and 443 from the IP ranges 203.0.113.0/24 and 198.51.100.0/24 to instances with the tag 'web-server'. Which traffic will this rule allow?

Accepted Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to instances with tag 'web-server'. The rule in question is an inbound firewall rule that allows TCP traffic on ports 80 and 443 from specific IP ranges to instances with the tag 'web-server'. Therefore, option D correctly describes the traffic allowed by this rule.

Answer

Outbound TCP traffic on ports 80 and 443 from instances with tag 'web-server' to IP ranges

Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to all instances

Answer

Inbound TCP traffic on ports 80 and 443 from any IP address to instances with tag 'web-server'

Question 10

A company uses preemptible VMs for batch processing. They notice that during peak hours, many instances are terminated before finishing their tasks. The operations team observes the output shown in the exhibit. Which action would best improve job completion rates without significantly increasing costs?

Accepted Answer

Use instance groups with a mix of preemptible and regular VMs. Using a mixed instance group with both preemptible and regular VMs allows the batch processing job to continue on regular VMs when preemptible VMs are terminated during peak hours. This balances cost and reliability: preemptible VMs handle most of the workload at low cost, while regular VMs act as a fallback to ensure job completion without the full expense of switching entirely to regular VMs.

Answer

Increase the number of instances to compensate for terminations

Answer

Use sole-tenant nodes for these instances

Answer

Use committed use discounts for 1 year

Answer

Switch to regular VMs for critical jobs

Question 11

A company runs a web application on Compute Engine behind a Global HTTPS Load Balancer. Users report slow page loads, especially for static assets. The development team wants to cache content closer to users without modifying code. Which GCP service should they enable?

Accepted Answer

Cloud CDN. Cloud CDN uses Google's global edge cache to deliver content close to users. It can be enabled on the load balancer backend buckets (for Cloud Storage) or backend services (for Compute Engine). Cloud Armor is for security, Cloud DNS for domain resolution, and Cloud NAT for outbound connectivity.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

Cloud DNS

Question 12

A developer runs the command above. The instance is created successfully, but cannot be reached via HTTP from the internet. What is the most likely cause?

Accepted Answer

There is no firewall rule allowing ingress traffic on ports 80 and 443.. The most likely cause is that there is no firewall rule allowing ingress traffic on ports 80 and 443. By default, Google Cloud Platform (GCP) firewall rules block all incoming traffic from the internet. Even though the instance is created successfully, HTTP/HTTPS traffic cannot reach it unless a firewall rule explicitly permits ingress on TCP ports 80 and 443, typically via a target tag like 'http-server' or 'https-server'.

Answer

The machine type n1-standard-2 is not suitable for HTTP.

Answer

The image family debian-10 does not support HTTP.

Answer

The boot disk type pd-standard is too slow.

Question 13

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

Accepted Answer

Attach an IAM policy to an organization. Attaching an IAM policy to an organization (option A) is a valid method because it allows you to set organization-wide policies that apply to all projects and resources within that organization. This is a fundamental feature of Google Cloud's hierarchical resource management, where policies can be inherited from the organization node down to folders and projects, enabling centralized control over access.

Answer

Attach an IAM policy to a user

Answer

Assign an IAM role directly to a user

Answer

Attach an IAM policy to a service account

Question 14

A company is migrating its on-premises Oracle database to Cloud SQL for PostgreSQL. The database team wants to minimize downtime during migration. Which approach should they use?

Accepted Answer

Use Database Migration Service for PostgreSQL with continuous migration from Oracle via Homogeneous Migration.. Database Migration Service (DMS) for PostgreSQL with continuous migration is the correct approach because it supports ongoing change data capture (CDC) from Oracle to Cloud SQL for PostgreSQL, enabling near-zero downtime. DMS handles schema conversion and data replication continuously, allowing the target to stay synchronized until a cutover, which minimizes downtime compared to batch methods.

Answer

Set up Oracle GoldenGate to replicate to Cloud SQL.

Answer

Take a physical backup of Oracle and restore to Cloud SQL.

Answer

Export the database as a dump file, upload to Cloud Storage, and import into Cloud SQL.

Question 15

A company runs a latency-sensitive web application on Compute Engine with a managed instance group (MIG) behind an HTTP load balancer. They want to reduce latency for users in Europe and Asia. Which THREE actions should they take?

Accepted Answer

Enable Cloud CDN to cache static content. Creating MIGs in multiple regions and using a global HTTP Load Balancer distributes traffic to the closest region. Cloud CDN caches static content at edge locations, reducing latency. Enabling auto-scaling ensures there are enough instances to handle traffic. Using a single regional load balancer would not serve multiple regions efficiently. Preemptible VMs are not suitable for latency-sensitive workloads.

Answer

Use a regional external load balancer for each region

Answer

Use preemptible VMs to reduce costs in non-primary regions

Question 16

A team deployed the Terraform configuration shown in the exhibit. They observe that Cloud NAT is not translating traffic from the private subnet as expected. What is the most likely cause?

Accepted Answer

The Cloud Router is not in the same VPC network as the private subnet. Cloud NAT requires a Cloud Router to be in the same VPC network as the subnet whose traffic needs translation. If the Cloud Router is in a different VPC network, the NAT gateway cannot establish the necessary BGP sessions or route traffic from the private subnet, causing NAT to fail silently.

Answer

The log filter is set to ERRORS_ONLY, which suppresses all logs

Answer

The NAT IP allocation is manual and no IPs were specified

Answer

The subnet is not included in the source_subnetwork_ip_ranges_to_nat list

Question 17

A company wants to restrict data exfiltration from its Google Cloud projects by preventing resources from copying data to external IP addresses. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls is the correct choice because it creates a security perimeter around Google Cloud resources, such as BigQuery or Cloud Storage, and prevents data exfiltration by blocking access from outside the perimeter or to external IP addresses. It enforces context-aware access policies that can deny egress traffic to non-permitted destinations, directly addressing the requirement to restrict copying data to external IPs.

Answer

HTTPS Load Balancer

Answer

Cloud Armor

Answer

Cloud NAT

Question 18

An e-commerce platform uses Cloud Spanner for order processing. Recently, latency spikes have occurred during flash sales. The team suspects hot spots due to monotonically increasing order IDs. Which table design change would best solve this?

Accepted Answer

Add a random prefix to the order ID primary key.. Monotonically increasing primary keys (like sequential order IDs) cause hot spots in Cloud Spanner because all writes are directed to a single split (tablet), overwhelming that node. Adding a random prefix (e.g., a hash of the customer ID) distributes writes across multiple splits, eliminating the hot spot and reducing latency spikes during high-throughput flash sales.

Answer

Remove the primary key and let Spanner auto-generate it.

Answer

Use interleaved tables to store orders under customers.

Answer

Create a secondary index on the timestamp column.

Question 19

An e-commerce application uses Firestore for product catalog. They need to run complex analytical queries on the catalog data, such as aggregations and joins, without impacting production performance. What is the best approach?

Accepted Answer

Export Firestore data to BigQuery for analytics. Firestore is not designed for analytical queries. Exporting to BigQuery allows running complex analytics without impacting Firestore performance. Using a second Firestore database increases cost but doesn't improve analytics. Cloud SQL does not natively integrate with Firestore. Using the `!=` operator doesn't solve analytical needs.

Answer

Create a second Firestore database for analytics

Answer

Use Cloud SQL to query Firestore directly

Answer

Use Firestore `!=` operator to filter data

Question 20

Which THREE actions can help reduce costs for a BigQuery workload that runs frequent, ad-hoc analytical queries on a large dataset?

Accepted Answer

Partition the table by a date or timestamp column.. Partitioning the table by a date or timestamp column (Option B) reduces the amount of data scanned by BigQuery for queries that filter on that column, directly lowering query costs (pay-per-byte model). It also improves performance by pruning irrelevant partitions, making it a core cost-saving technique for ad-hoc analytical workloads.

Answer

Enable automatic schema detection to avoid manual schema definition.

Answer

Use flat-rate pricing with reserved slots.