Google PCA Practice Exam 54 — 20 Questions

Question 1

A company wants to allow developers to create service accounts in a project but prevent them from granting the 'roles/iam.serviceAccountUser' role to any user. Which organization policy constraint should they set?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the constraint 'iam.restrictGrantableRoles' to ['roles/iam.serviceAccountUser'].. The 'iam.restrictGrantableRoles' organization policy constraint limits which roles can be granted to principals. By setting this constraint to include only 'roles/iam.serviceAccountUser', developers are allowed to create service accounts but are prevented from granting that specific role to any user. This constraint operates at the organization, folder, or project level and restricts the set of roles that can be granted in IAM policies, effectively blocking the assignment of the listed roles.

Answer

Set the constraint 'iam.allowedPolicyMemberDomains' to include only the company's domain.

Answer

Set the constraint 'iam.disableServiceAccountKeyCreation' to True.

Answer

Set the constraint 'iam.workloadIdentityPoolProviders' to deny all.

Question 2

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the cluster can automatically scale based on custom metrics, such as the number of pending requests per pod. Which two steps should they take? (Choose TWO)

Accepted Answer

Deploy the Metrics Server in the cluster to expose custom metrics via the Custom Metrics API.. The Metrics Server is required to expose custom metrics via the Custom Metrics API in GKE. Without it, the HorizontalPodAutoscaler (HPA) cannot retrieve the custom metrics needed for scaling decisions. Option B is correct because the application must expose custom metrics (e.g., pending requests) through an endpoint, and the HPA must be configured to reference that custom metric name to trigger scaling based on that specific value.

Answer

Enable the Cloud Monitoring API and create a custom dashboard to track pending requests.

Answer

Configure a HorizontalPodAutoscaler (HPA) with the target average CPU utilization set to 80%.

Answer

Enable GKE Autopilot mode to automatically manage scaling based on custom metrics.

Question 3

A company is designing a data processing pipeline in Google Cloud that must be HIPAA compliant. Which three security features should they implement? (Choose three.)

Accepted Answer

Encrypt data in transit using TLS. Encrypting data in transit using TLS is a mandatory security control for HIPAA compliance because it protects electronic protected health information (ePHI) from interception during transmission over networks. TLS 1.2 or higher ensures that data moving between clients, services, and Google Cloud endpoints is encrypted, meeting the HIPAA Security Rule requirement for integrity and confidentiality of ePHI in transit.

Answer

Enable Data Loss Prevention (DLP) for data classification

Answer

Use Cloud CDN for faster delivery

Question 4

A company is using Cloud Armor to protect their external HTTPS load balancer. They want to block traffic from a specific list of IP ranges. They create a security policy with a deny rule. However, the denials seem not to be applied to all backend services. What is the most likely cause?

Accepted Answer

The security policy is attached to the load balancer's target proxy, but the deny rule priority is lower than an allow rule. Cloud Armor security policies are evaluated against the rules in priority order, with lower numbers having higher priority. If a deny rule has a higher priority number (lower priority) than an allow rule, the allow rule will be evaluated first and permit the traffic, effectively overriding the deny. The most likely cause is that the deny rule's priority is not set lower than any conflicting allow rules, so the allow rule matches first.

Answer

The security policy is not attached to the backend service

Answer

Cloud Armor policies only apply to global load balancers, not regional

Answer

The security policy has an allow rule that overrides the deny rule

Question 5

A company wants to optimize their network costs for inter-region traffic using Cloud VPN. What is the most cost-effective configuration?

Accepted Answer

Use a single VPN tunnel with dynamic routing.. A single VPN tunnel with dynamic routing (BGP) is the most cost-effective configuration for inter-region traffic using Cloud VPN. Cloud VPN charges per tunnel-hour and per GB of data processed, so using a single tunnel minimizes the hourly cost while dynamic routing ensures automatic failover and route advertisement without needing multiple tunnels.

Answer

Use partner interconnect.

Answer

Use Cloud NAT.

Answer

Use dedicated interconnect.

Question 6

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single on-premises server and uses a local MySQL database. The company wants to minimize changes to the application code while improving scalability and reliability. Which migration strategy should the architect recommend?

Accepted Answer

Rehost the application on Compute Engine and use Cloud SQL for MySQL as the database.. Rehosting (lift-and-shift) the monolithic application to Compute Engine with Cloud SQL for MySQL minimizes code changes while improving scalability and reliability. Cloud SQL provides managed MySQL with automated backups, replication, and failover, addressing the need for reliability without requiring application refactoring.

Answer

Refactor the application into microservices and deploy on Google Kubernetes Engine.

Answer

Containerize the application with Docker and run it on Cloud Run.

Answer

Migrate the database to Firestore and rewrite the application to use Firestore APIs.

Question 7

A developer accidentally deleted a bucket in Cloud Storage. The bucket had object versioning enabled. How can the bucket and its objects be restored?

Accepted Answer

Contact Cloud Support to restore the bucket from the undisclosed backup within a limited time window.. When a Cloud Storage bucket is deleted, even with versioning enabled, the bucket itself is removed along with its objects. Google Cloud does not provide a self-service restore option for deleted buckets; instead, it maintains an internal, undisclosed backup for a limited time (typically 7 days). Only Cloud Support can initiate the restoration process from this backup, making Option A the correct approach.

Answer

Restore the bucket from the Trash in the Cloud Console.

Answer

Enable bucket lock and then undo deletion.

Answer

Use the gsutil ls -a command to list deleted buckets and gsutil cp to restore.

Question 8

Refer to the exhibit. A DevOps engineer created this Terraform configuration to deploy a Compute Engine instance. After applying, they notice the instance is not accessible from the internet. What is the most likely cause?

Accepted Answer

No firewall rule allows ingress traffic to the instance.. The most likely cause is that no firewall rule allows ingress traffic to the instance. By default, GCP instances are created with a VPC network that has implied deny-all ingress rules, and unless a specific firewall rule (e.g., allowing tcp:22 for SSH or tcp:80 for HTTP) is applied to the instance's network tags or service account, all inbound traffic from the internet is blocked. The Terraform configuration shown in the exhibit likely omitted a `google_compute_firewall` resource or did not assign the necessary network tags to the instance.

Answer

The machine type e2-medium does not support public IP addresses.

Answer

The instance is not attached to a VPC network.

Answer

The boot disk size is too small to run the operating system.

Question 9

A DevOps team is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the pods can securely access Google Cloud APIs (e.g., Cloud Storage) without managing service account keys. Which TWO steps should they take? (Choose two.)

Accepted Answer

Create a dedicated GCP service account with necessary roles and bind it to Kubernetes service accounts via Workload Identity.. Workload Identity allows you to bind a Kubernetes service account to a GCP service account, enabling pods to authenticate to Google Cloud APIs (e.g., Cloud Storage) without managing or storing service account keys. This eliminates the security risk of key leakage and simplifies credential rotation. Option D is correct because Workload Identity must be explicitly enabled on the GKE cluster (using the `--workload-pool` flag or via the console) before the binding can be established.

Answer

Use the Compute Engine default service account on each node.

Answer

Use a secrets management solution like HashiCorp Vault to store service account keys and retrieve them at runtime.

Answer

Store service account keys in a Kubernetes Secret and mount them into pods.

Question 10

Refer to the exhibit. A user (ops@example.com) is unable to create a new VPC network in the project. What should the administrator verify first?

Accepted Answer

The user has appropriate IAM roles such as roles/compute.networkAdmin.. To create a VPC network in Google Cloud, the user needs the compute.networks.create permission. The roles/compute.networkAdmin IAM role includes this permission, along with others needed to manage VPC networks. Option D correctly identifies that the user must have appropriate IAM roles, specifically roles/compute.networkAdmin or a custom role with the necessary compute.networks.create permission.

Answer

The user has been granted roles/compute.admin.

Answer

The user has the project owner role.

Answer

The user has the roles/storage.admin role.

Question 11

A developer notices that web-server-1 is preemptible. They want to ensure their application remains available even if this instance is terminated. What should they do?

Accepted Answer

Create a managed instance group for web-server-1 and set an autoscaler.. A managed instance group (MIG) with an autoscaler ensures that if the preemptible instance is terminated, the MIG automatically recreates it to maintain the desired number of instances. This provides resilience against preemption by restoring capacity without manual intervention. The load balancer can then distribute traffic across healthy instances in the group.

Answer

Modify the instance's preemptible flag to false.

Answer

Create a load balancer pointing to web-server-1's external IP.

Answer

Create a snapshot schedule for web-server-1.

Question 12

An organization wants to enforce that all Compute Engine VMs are created with specific disk encryption keys. Which policy mechanism should they use?

Accepted Answer

Organization policies with constraints/compute.restrictDiskEncryptionKeyTypes. The Organization Policy constraint `constraints/compute.restrictDiskEncryptionKeyTypes` allows administrators to enforce that all Compute Engine VMs must use specific disk encryption key types (e.g., CMEK or CSEK). This policy is evaluated at resource creation time and blocks any VM that does not comply with the allowed key types, providing a preventive control rather than a reactive one.

Answer

IAM roles with compute.diskEncryptionKey permissions

Answer

VPC Service Controls

Answer

Cloud Scheduler to check compliance

Question 13

A company has a Cloud SQL for PostgreSQL instance with high read traffic. They want to offload read queries without modifying the application. Which strategy should they implement?

Accepted Answer

Create read replicas and configure the application to use them. Creating read replicas in Cloud SQL for PostgreSQL allows you to offload read traffic from the primary instance without modifying the application, because the replicas are fully managed and can serve read queries directly. The application can be configured to point to the read replica's endpoint, which handles SELECT statements while the primary continues to handle writes. This is the most direct and cost-effective solution for high read traffic when application changes are not permitted.

Answer

Increase the machine type of the primary instance

Answer

Implement a caching layer using Memorystore

Answer

Migrate to Cloud Spanner for better scalability

Question 14

A company uses BigQuery for analytics and has a large number of ad-hoc queries from different teams. Costs are rising unpredictably. They want to control costs while maintaining query performance. What should they do?

Accepted Answer

Purchase flat-rate slots and assign them to a reservation for each team.. Purchasing flat-rate slots and assigning them to a reservation for each team provides predictable, fixed-cost capacity for BigQuery. This eliminates the unpredictability of on-demand pricing while allowing teams to share a dedicated pool of slots, ensuring consistent query performance without unexpected cost spikes.

Answer

Use partitioning and clustering to reduce data scanned.

Answer

Reduce the number of slots available to each team.

Answer

Require each team to include a cost code in their queries.

Question 15

A company runs a batch processing workload on Compute Engine that processes financial transactions. The workload runs daily and must complete within a 4-hour window. The application reads input data from Cloud Storage, processes it, and writes output to another Cloud Storage bucket. The current implementation uses a single VM with a 500 GB persistent disk. Recently, the data volume has increased, and the job is now taking over 6 hours, exceeding the SLA. The team is tasked with redesigning the solution to be faster and more reliable. They want to minimize costs and operational overhead. The data is critical and must not be lost. Which approach should they take?

Accepted Answer

Use Cloud Dataflow with autoscaling to process the data in parallel.. Cloud Dataflow with autoscaling is the correct choice because it provides a fully managed, serverless service for parallel data processing that can automatically scale resources based on the volume of data. This directly addresses the need to complete the batch workload within the 4-hour SLA, as Dataflow can distribute the processing across many workers, significantly reducing execution time. It also ensures reliability and data durability through checkpointing and exactly-once processing semantics, meeting the critical data loss prevention requirement.

Answer

Use a managed instance group with a startup script that processes data, and use Cloud Pub/Sub to coordinate.

Answer

Increase the VM to a high-CPU machine type with a regional persistent disk for HA.

Answer

Deploy the processing logic in Cloud Functions and trigger from Cloud Storage events.

Question 16

Your company has a production environment on Google Cloud that includes Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Security policies require that all data at rest is encrypted with CMEK, and audit logs must be retained for 7 years. The current configuration uses Google-managed encryption keys. You have been asked to transition to CMEK for all resources. After enabling CMEK for new resources, you discover that the existing resources are not re-encrypted. To comply with the policy, you need to re-encrypt the existing data. What should you do?

Accepted Answer

For Compute Engine: create new disks with CMEK, attach them, and copy data. For Cloud Storage: rewrite objects with CMEK. For BigQuery: copy datasets to new datasets with CMEK.. CMEK is applied at the resource creation level for Compute Engine disks, Cloud Storage buckets, and BigQuery datasets. Existing resources encrypted with Google-managed keys cannot be re-encrypted in place; you must create new resources with CMEK enabled and migrate the data. For Compute Engine, this means creating new disks with CMEK, attaching them, and copying data. For Cloud Storage, you rewrite objects to a new bucket or use the rewrite API with CMEK. For BigQuery, you copy datasets to new datasets that have CMEK configured.

Answer

Enable CMEK on the existing resources by modifying the resource's encryption settings. This will automatically re-encrypt the data.

Answer

Delete the existing resources and recreate them with CMEK enabled. Then restore data from backups.

Answer

Enable Data Loss Prevention (DLP) API to scan and re-encrypt data automatically.

Question 17

Your organization is implementing a Disaster Recovery plan for a critical database. Which THREE components are essential for a robust DR strategy? (Choose 3)

Accepted Answer

Automated failover process to switch traffic to the DR region.. An automated failover process is essential for minimizing Recovery Time Objective (RTO) in a Disaster Recovery strategy. Without automation, manual intervention introduces delays and risks of human error, which can extend downtime significantly. In cloud or on-premises environments, automated failover typically relies on health checks, DNS updates, or traffic manager rules to seamlessly redirect traffic to the DR region when the primary fails.

Answer

A single global load balancer for both regions.

Answer

Using a single zone for the primary region.

Question 18

Your company runs a critical multi-tier application: a global HTTP(S) load balancer, multiple regional managed instance groups (MIGs) for the web tier, and Cloud Spanner for the data tier. You need to design for zone-level and region-level failures. What architecture ensures the highest availability?

Accepted Answer

Use a global HTTP(S) load balancer with regional MIGs in multiple regions, each spanning zones, and a multi-region Cloud Spanner instance.. It combines a global HTTP(S) load balancer (which can route traffic to healthy backends across regions), regional MIGs that span multiple zones within each region (providing zone-level redundancy), and a multi-region Cloud Spanner instance (which provides synchronous replication across regions for strong consistency and automatic failover). This architecture ensures that if an entire zone or region fails, traffic is automatically redirected to healthy backends in other zones/regions, and Spanner continues to serve reads and writes without manual intervention.

Answer

Use a global HTTP(S) load balancer with a single global MIG and a multi-region Cloud Spanner instance.

Answer

Use a global HTTP(S) load balancer with a single zonal MIG and Cloud Spanner single-region.

Answer

Use a regional HTTP(S) load balancer with a regional MIG and Cloud SQL with cross-region replication.

Question 19

A company uses Cloud Logging to monitor their application logs. They notice that some logs from their Compute Engine instances are missing. The instances have the required logging permission. What is the most likely cause?

Accepted Answer

The logging agent is not configured to send logs to Cloud Logging.. Compute Engine instances do not automatically send logs to Cloud Logging. They require the Cloud Logging agent (based on fluentd) to be installed and configured to forward logs. Even with correct IAM permissions, without the agent, logs will not be collected. Option B correctly identifies this missing agent as the most likely cause.

Answer

The log sink is not configured correctly.

Answer

The instances are using a custom image without the logging agent.

Answer

The log bucket is in a different project.

Answer

The log entries are being filtered by the exclusion filter.

Question 20

A team runs a Cloud Spanner instance with a regional configuration. They need to increase write throughput for a global user base but are concerned about cost. What should they do?

Accepted Answer

Add more nodes to the instance. Adding nodes increases throughput and cost proportionally. Switching to multi-region increases latency for writes (due to synchronous replication) and cost. Using global indexes won't increase baseline write throughput. Recommending to use Firestore is not correct for this scenario.

Answer

Use global indexes

Answer

Migrate to Cloud Firestore in Datastore mode

Answer

Switch to a multi-region configuration