Google PCA Practice Exam 54 — 20 Questions

Question 1

A retail company runs a public-facing API on Cloud Run in the europe-west1 region. During a marketing campaign, traffic tripled within minutes. The service remained available, but some requests returned HTTP 503 errors. The team wants to reduce the chance of 503 errors during future traffic spikes while keeping the deployment simple. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the Cloud Run service's maximum number of instances to a high value and configure a minimum number of instances greater than zero.. The 503 errors occurred because the service hit its configured maximum instance count during the spike. Raising the maximum instance limit lets Cloud Run create enough instances to absorb the burst, and setting a minimum instance count above zero keeps warm instances available so the initial surge does not fail while new instances start. Resource limits, CDN caching, and multi-region deployment do not directly remove the instance ceiling that caused the rejections.

Answer

Increase the container's allocated memory and CPU limits in the Cloud Run revision settings.

Answer

Enable Cloud CDN on the Cloud Run service and set a long cache TTL for all responses.

Answer

Deploy the service to multiple Cloud Run regions and use a global external Application Load Balancer with a serverless network endpoint group.

Question 2

A healthcare company is designing a solution to ingest and process millions of patient records daily. The data must be stored in a way that supports SQL queries and also allows for real-time analytics. The company wants to minimize operational overhead and needs a fully managed, petabyte-scale data warehouse. Which Google Cloud service should the solutions architect recommend?

Accepted Answer

BigQuery.. BigQuery is a serverless, highly scalable data warehouse that supports SQL and real-time analytics. It is fully managed, so the healthcare company can focus on analyzing data rather than managing infrastructure. It handles petabyte-scale datasets and daily ingestion of millions of records without manual scaling, making it the best fit for the requirements.

Answer

Cloud Spanner.

Answer

Cloud Bigtable.

Answer

Cloud SQL for PostgreSQL.

Question 3

A healthcare analytics company must store patient records in Cloud Storage. Compliance requires that the data be encrypted with keys the company generates and rotates itself, and that the company retain the ability to revoke access by disabling the key. The data must remain readable by authorized applications in the same project. What should the architect implement?

Accepted Answer

Customer-managed encryption keys (CMEK) in Cloud KMS, referenced by the bucket's default encryption configuration.. Customer-managed encryption keys in Cloud KMS give the organization ownership of key material, rotation control, and the ability to disable a key to revoke access. Setting the bucket default encryption to a CMEK key applies that key to newly written objects, and IAM on the key governs which applications can decrypt.

Answer

Customer-supplied encryption keys (CSEK) passed with every object write and read request.

Answer

Google-managed encryption keys, relying on Cloud Storage default encryption.

Answer

Client-side encryption performed by the analytics application before uploading objects to Cloud Storage.

Question 4

A retail company operates a global e-commerce platform on Google Cloud. Their architects need to choose a load balancing solution that terminates TLS at the edge, provides a single global anycast IP address, and automatically routes users to the closest healthy backend. Which Google Cloud load balancing product should they select?

Accepted Answer

Global external Application Load Balancer (HTTP(S)). The global external Application Load Balancer is built for internet-facing global services: it provides a single anycast IP, terminates TLS at Google's edge, and uses Google's global network to send each user to the nearest healthy backend. A regional load balancer cannot give one global IP, and layer 4 passthrough options do not terminate TLS or perform HTTP-aware global routing.

Answer

Internal Application Load Balancer (HTTP(S))

Answer

Regional external Application Load Balancer (HTTP(S))

Answer

External passthrough Network Load Balancer

Question 5

A retail company is deploying a customer-facing API on Google Cloud. The API must survive the loss of an entire region with minimal data loss and must serve users in North America, Europe, and Asia with low latency. The database layer must support strongly consistent reads and writes. Which design should the architect choose for the data tier?

Accepted Answer

Cloud Spanner with a multi-region instance configuration, with application instances reading and writing through regional endpoints.. Cloud Spanner is the Google Cloud database that provides synchronous multi-region replication with external consistency, so losing a region does not lose committed writes and reads stay strongly consistent. Regional endpoints let each continent's application instances talk to nearby replicas while the multi-region quorum maintains durability and correctness.

Answer

Firestore in Datastore mode with a multi-region location and client-side caching of query results.

Answer

Bigtable with a multi-cluster routing policy and application-level retries for failed writes.

Answer

A single Cloud SQL for PostgreSQL instance in us-central1 with cross-region read replicas in europe-west1 and asia-east1.

Question 6

A financial services firm is designing a new application on Google Cloud. The application must store sensitive customer data and comply with regulations that require encryption at rest with keys managed by the company. The company also needs to control key rotation and revocation. Which Google Cloud service should the solutions architect use to meet these requirements?

Accepted Answer

Cloud Key Management Service (Cloud KMS) with customer-managed encryption keys (CMEK).. Cloud KMS with customer-managed encryption keys gives the company full control over the lifecycle of encryption keys, including rotation and revocation, while integrating with Google Cloud services to encrypt data at rest. This meets the regulatory requirement for company-managed keys. Other services like IAP or DLP address different aspects of security and do not provide key management.

Answer

Cloud HSM to provide hardware security modules for key storage.

Answer

Cloud Data Loss Prevention (DLP) to discover and redact sensitive data.

Answer

Cloud Identity-Aware Proxy (IAP) to enforce access control and encrypt data in transit.

Question 7

A healthcare analytics company is designing the Google Cloud landing zone for a new HIPAA-regulated workload. The security team requires that no project in the organization can enable a public Cloud Storage bucket by accident, and that all data-at-rest in BigQuery is encrypted with keys the company rotates on its own schedule. Which two design decisions should the architect include? (Choose two.)

Accepted Answer

Create a Cloud KMS keyring in each region where BigQuery datasets reside, and set a default CMEK on each dataset. Two controls map directly to the stated requirements. The storage.publicAccessPrevention organization policy is a preventive, inherited guardrail that blocks public bucket grants anywhere in the organization. A default CMEK on each BigQuery dataset, with regional keyrings, gives the company control over the rotation schedule and key lifecycle. Uniform bucket-level access, Google-managed keys, and narrow role grants do not enforce either requirement.

Answer

Enable uniform bucket-level access on every bucket through an organization policy constraint

Answer

Grant the Storage Admin role only to a small group of platform engineers at the organization level

Answer

Use Google-managed encryption keys for BigQuery and rely on the default rotation performed by Google

Question 8

A healthcare company stores sensitive patient data in Cloud Storage. They must ensure that data is encrypted at rest with a key that they manage, and that the key is automatically rotated every 90 days. They also need to be able to audit key usage. Which approach should they take?

Accepted Answer

Create a Cloud KMS key with a rotation period of 90 days, grant the Cloud Storage service account encrypt/decrypt permissions on the key, and configure the bucket to use that key as the default encryption key.. Cloud KMS provides automatic key rotation and audit logging. By setting a bucket default key, all objects are encrypted with the CMEK. Granting the Cloud Storage service account encrypt/decrypt permissions is required for the bucket to use the key. This approach meets encryption, rotation, and auditing requirements with minimal overhead.

Answer

Use a Cloud HSM key with a rotation period of 90 days, and configure the bucket with a retention policy that enforces encryption.

Answer

Use Customer-Supplied Encryption Keys (CSEK) with a 90-day rotation managed by the application, and enable Cloud Audit Logs for Cloud Storage.

Answer

Create a Cloud KMS key with a rotation period of 90 days, and use an organization policy constraint to require CMEK on all Cloud Storage buckets.

Question 9

A government agency must run sensitive analytics in BigQuery while ensuring that analysts can see aggregated results but never the raw values of specific personal data columns. Analysts use SQL and must not be able to bypass the restriction by writing their own queries. The agency also needs to record who queried which columns. Which combination should the architect use?

Accepted Answer

Create a policy tag taxonomy in Data Catalog, assign a policy tag to the sensitive columns, and grant analysts the fine-grained reader role on the tag so they see masked values, while column access is recorded in audit logs.. Column-level security in BigQuery is delivered through policy tags in Data Catalog. Assigning a policy tag to the sensitive columns and granting analysts only the fine-grained reader role on that tag causes BigQuery to return masked values for those columns while still allowing aggregation over the rest of the table. Because enforcement happens inside the query engine, analysts cannot bypass it with custom SQL, and column access is captured in data access audit logs.

Answer

Encrypt the sensitive columns with a customer-managed key and grant analysts the crypto key decrypter role only for aggregate queries.

Answer

Create a view that omits the sensitive columns and grant analysts access only to the view, revoking access to the base table.

Answer

Grant analysts roles/bigquery.dataViewer on the dataset and rely on BigQuery's default access controls to prevent them from seeing sensitive columns.

Question 10

A healthcare company must store patient documents in Cloud Storage. Compliance requires that the data be encrypted with keys the company controls and that key usage be centrally audited and revocable. The architect plans to use Cloud KMS. Which two actions should the architect take to meet these requirements? (Choose two.)

Accepted Answer

Create a Cloud KMS key ring and a customer-managed encryption key (CMEK) in the same region as the bucket, and configure the bucket to use that key as its default encryption key.. Meeting the compliance goals requires a customer-managed encryption key configured as the bucket's default encryption key, plus the Cloud Storage service agent holding cryptoKeyEncrypterDecrypter on that key. Together these ensure all objects are encrypted with a company-controlled key and that every key operation is recorded in Cloud Audit Logs, enabling auditing and revocation through Cloud KMS.

Answer

Create a customer-supplied encryption key (CSEK) and store it in Secret Manager for each object upload.

Answer

Enable Cloud External Key Manager (Cloud EKM) backed by keys held in a third-party HSM.

Answer

Enable uniform bucket-level access on the bucket to force CMEK usage.

Question 11

A company is deploying a new microservices application on Google Kubernetes Engine (GKE). They need to ensure that each microservice can be independently scaled and updated without affecting other services. They also want to minimize the blast radius of a failure in one microservice. Which design approach should they use?

Accepted Answer

Deploy each microservice as a separate Deployment with its own Horizontal Pod Autoscaler and use separate namespaces for isolation.. Using separate Deployments for each microservice enables independent scaling and rolling updates. Each Deployment can have its own HPA, and namespaces provide isolation. This design minimizes the impact of a failure in one service and aligns with microservices best practices. The other options either couple services together or lack automation and resilience.

Answer

Deploy all microservices in a single Deployment with multiple containers per pod.

Answer

Deploy each microservice as a separate pod without a controller, and manage them manually.

Answer

Use a single StatefulSet for all microservices to maintain persistent identities.

Question 12

A media company is preparing to migrate a batch reporting application to Google Cloud. The application currently runs on physical servers that are used at about 20 percent CPU on average, but it has two short month-end peaks each quarter when utilization reaches 90 percent for about six hours. The company wants to reduce infrastructure cost while guaranteeing the application always has enough capacity during the peaks. What should the architect recommend?

Accepted Answer

Deploy the application on a managed instance group with autoscaling based on CPU utilization, with a minimum size that covers baseline load and a maximum size that covers the peaks.. The workload is spiky, with a low average and short, predictable peaks. Horizontal autoscaling on managed instance groups matches that shape: the group grows during the month-end surge and shrinks afterward, so cost tracks actual demand while the maximum size preserves guaranteed headroom. Fixed peak sizing, cluster autoscaler with a peak-sized minimum, and pinned Cloud Run minimum instances all keep peak capacity running continuously.

Answer

Deploy the application on a managed instance group of Compute Engine VMs sized for the month-end peak, using a committed use discount for the full capacity.

Answer

Deploy the application to a Google Kubernetes Engine cluster with a single large node pool and enable cluster autoscaler with a minimum node count equal to the peak requirement.

Answer

Deploy the application to Cloud Run with a minimum instance count set to the number of instances needed at peak and concurrency set to one.

Question 13

A financial services company runs a payment processing platform on Compute Engine. Compliance requires that all data at rest be encrypted with keys the company controls and that key material never leave their on-premises HSM appliances. They must also minimize operational overhead for key rotation. Which Google Cloud solution should the architect recommend?

Accepted Answer

Cloud External Key Manager (Cloud EKM) with an external key manager. The strict requirement is that key material must remain in the company's on-premises HSMs while still protecting Google Cloud resources. Cloud EKM is designed exactly for this: it lets Cloud services use CMEK backed by an external key manager, so Google never holds the key material. CSEK requires manual key handling, Cloud KMS stores keys in Google Cloud, and default encryption gives no customer control.

Answer

Default Google-managed encryption at rest with CMEK disabled

Answer

Customer-supplied encryption keys (CSEK) stored in a local vault

Answer

Cloud KMS with CMEK and automatic rotation

Question 14

A startup is deploying a new containerized web application to Google Cloud. The team wants the simplest way to run containers without managing Kubernetes nodes, needs automatic scaling from zero, and wants to pay only when requests are being handled. Which Google Cloud service should the architect recommend?

Accepted Answer

Cloud Run, deploying the container image and configuring the service to allow unauthenticated or authenticated invocations.. Cloud Run is a fully managed container runtime that abstracts away nodes, scales instances down to zero when idle, and charges for the resources consumed while handling requests. Deploying a container image and choosing the invocation authentication model is all that is required. This matches the startup's priorities of minimal operational effort, automatic scale-from-zero, and consumption-based billing without adopting Kubernetes.

Answer

App Engine flexible environment with a custom runtime for the container.

Answer

Google Kubernetes Engine with a zonal cluster and cluster autoscaler enabled.

Answer

Compute Engine managed instance groups running the container with a startup script that installs Docker.

Question 15

A company is designing a hybrid cloud architecture where on-premises applications need to access data stored in a Cloud Storage bucket. The company requires that traffic between on-premises and Google Cloud does not traverse the public internet and must be encrypted. They also need dedicated bandwidth. Which Google Cloud service should the solutions architect use?

Accepted Answer

Cloud Interconnect with Dedicated Interconnect.. Dedicated Interconnect offers a private, dedicated connection between on-premises and Google Cloud, avoiding the public internet and providing consistent bandwidth. It supports encryption through MACsec or higher-layer protocols. This satisfies the requirements for private, encrypted, and dedicated connectivity for accessing Cloud Storage data.

Answer

VPC Network Peering between on-premises and Google Cloud.

Answer

Cloud CDN with private origin access.

Answer

Cloud VPN with HA VPN.

Question 16

A small development team is prototyping a containerized application on Google Cloud. They want the least operational overhead for running containers, automatic scaling based on incoming requests, and the ability to scale to zero when there is no traffic. They do not need Kubernetes APIs or custom networking. Which compute option should the architect recommend?

Accepted Answer

Cloud Run services with request-based autoscaling. Cloud Run is a fully managed serverless platform for containers that scales automatically based on requests and can scale to zero when idle. It removes the need to manage clusters, nodes, or autoscaling policies, which directly addresses the team's desire for minimal operational overhead and cost efficiency during periods without traffic.

Answer

Google Kubernetes Engine Autopilot cluster

Answer

Compute Engine managed instance groups with an autoscaler

Answer

Cloud Functions with a container image as the deployment artifact

Question 17

A healthcare company stores patient records in a Cloud Storage bucket. Compliance requires that all data be encrypted with customer-managed keys, and that the company can revoke access to the data by disabling the key. They also need to audit every key usage. Which approach should they take?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS and enable Cloud Audit Logs for Cloud KMS.. Customer-Managed Encryption Keys (CMEK) in Cloud KMS allow the organization to control the encryption key lifecycle, including disabling the key to revoke access to data. Enabling Cloud Audit Logs for Cloud KMS provides an audit trail of all key operations, which is essential for compliance. This combination meets both the encryption control and auditing requirements.

Answer

Use default Google encryption and configure a Cloud Storage retention policy.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and enable Cloud Audit Logs for Cloud Storage.

Answer

Use Google-managed encryption keys (GMEK) and enable Cloud Audit Logs for Cloud Storage.

Question 18

A startup wants to deploy a containerized web application that must scale automatically based on incoming request concurrency. The team wants to avoid managing Kubernetes nodes or clusters and prefers a fully managed serverless platform with per-request billing. Which Google Cloud service should the architect recommend?

Accepted Answer

Cloud Run. Cloud Run is the managed serverless container platform that scales on request concurrency, scales to zero, and bills per request, with no cluster or node administration. It accepts standard container images, so the startup can deploy its existing artifact directly while gaining automatic scaling and usage-based pricing that the other options cannot provide.

Answer

Google Kubernetes Engine Autopilot

Answer

Compute Engine managed instance group with autoscaling

Answer

App Engine standard environment

Question 19

A financial services company is designing a hybrid cloud architecture. They have an on-premises data center and want to extend their VPC network to Google Cloud. They require a dedicated, high-bandwidth, low-latency connection with a SLA, and they need to encrypt traffic in transit. They also want to avoid using the public internet. Which connectivity option should they choose?

Accepted Answer

Cloud Interconnect - Dedicated Interconnect. Dedicated Interconnect is the correct choice because it offers a direct, dedicated physical connection with high bandwidth, low latency, and an SLA, and it does not use the public internet. It can be encrypted with MACsec or application-level encryption, satisfying the security requirement. Partner Interconnect and HA VPN do not provide the same dedicated, high-performance characteristics.

Answer

Cloud Interconnect - Partner Interconnect

Answer

Cloud VPN with HA VPN

Answer

Cloud CDN with Cloud VPN

Question 20

A retail company runs a legacy order-processing system on a single Compute Engine VM with a local SSD. The system is business-critical and must be migrated to Google Cloud with minimal downtime and no data loss. The database is PostgreSQL, and the company wants to move to a managed service. The cutover window is only 30 minutes. Which migration approach should the architect recommend?

Accepted Answer

Use Database Migration Service to perform a continuous replication from the source PostgreSQL to Cloud SQL for PostgreSQL, then promote during the cutover window.. Database Migration Service provides continuous replication from a self-managed PostgreSQL source to Cloud SQL, enabling a short cutover window with minimal downtime and no data loss. The other options either require significant downtime, are unsupported, or do not result in a managed service. For a business-critical system with a tight cutover window, continuous replication is the recommended approach.

Answer

Take a cold backup of the PostgreSQL database, transfer it to Cloud Storage, and restore it to a new Cloud SQL instance during the cutover window.

Answer

Lift and shift the VM to a Compute Engine instance with a persistent disk, then convert it to a Cloud SQL instance later.

Answer

Create a Cloud SQL read replica from the on-premises PostgreSQL using native replication, then promote the replica during cutover.