Google PCA Practice Exam 55 — 20 Questions

Question 1

A healthcare company stores patient documents in Cloud Storage. Compliance requires that documents be retained for seven years and that no user, including administrators, can delete or overwrite them during that period. The company wants the simplest configuration that enforces this. What should the architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a bucket retention policy with a retention period of seven years and lock the policy.. The requirement is for immutable retention that even administrators cannot bypass. A bucket retention policy sets a minimum retention period during which objects cannot be deleted or replaced, and locking the policy makes it permanent. Object Versioning, IAM deny rules, and cross-bucket copies do not provide the same enforceable, time-bound guarantee against both deletion and overwrite.

Answer

Enable Object Versioning and configure a lifecycle rule to delete noncurrent versions after seven years.

Answer

Apply a bucket-level IAM policy that denies the storage.objects.delete permission to all users.

Answer

Use a Cloud Storage transfer job to copy objects to a second bucket in a different region every day.

Question 2

A retail company runs a monolithic Java application on Compute Engine instances in a single managed instance group behind an external Application Load Balancer. During a flash sale, the application becomes unresponsive, and the operations team observes that the CPU utilization of all instances reaches 100%. The team wants to ensure that the application remains available during similar events. They need a solution that automatically adjusts capacity based on demand and minimizes manual intervention. Which approach should they take?

Accepted Answer

Configure an autoscaler on the managed instance group to scale based on CPU utilization with a target of 60%.. The managed instance group autoscaler with a CPU utilization target automatically adjusts the number of instances to maintain performance. It is the native, direct solution for scaling Compute Engine workloads based on demand, requiring no application changes. The other options either do not provide automatic scaling, require significant re-architecture, or rely on manual actions that cannot respond quickly enough.

Answer

Increase the size of each Compute Engine instance to a larger machine type to handle the peak load.

Answer

Set up a Cloud Monitoring alert that notifies the operations team when CPU utilization exceeds 80%, so they can manually add instances.

Answer

Deploy the application to a Google Kubernetes Engine cluster with a Horizontal Pod Autoscaler based on CPU utilization.

Question 3

A retail company is building a new application on Google Cloud. The security team requires that all data at rest be encrypted with keys the company manages, that key usage be auditable, and that the application on Compute Engine never store long-lived credentials on disk. The architect is selecting controls for the design. (Choose two.)

Accepted Answer

Create a Cloud KMS key ring in the same region as the data and use a customer-managed encryption key (CMEK) to encrypt the disks and databases.. The two requirements are company-controlled encryption keys and no long-lived credentials on the instances. Customer-managed encryption keys in Cloud KMS satisfy the first, with audit logging of key use built in. Attaching a service account and pulling short-lived tokens from the metadata server satisfies the second, because the workload never needs a downloaded key file. Together they cover the mandated controls without adding an external key manager dependency.

Answer

Enable Cloud External Key Manager with a third-party provider to hold the root key material for all disks and databases.

Answer

Use Google-managed encryption keys for the disks and rely on Cloud Audit Logs to record who accessed the data.

Answer

Store a service account key JSON file in Secret Manager and mount it into the instance at boot through a startup script.

Question 4

An e-commerce company runs its order-processing service on Cloud Run. During flash sales, the service experiences sudden traffic spikes, and the operations team observes that new instances take too long to start, causing elevated latency and some request failures. The service has a large container image and initializes database connection pools at startup. Which configuration change should the team make to reduce cold-start impact while controlling cost?

Accepted Answer

Set the minimum number of instances to a value greater than zero and enable CPU always allocated for the service.. Cold starts occur when Cloud Run must start a new instance, and the large image plus startup initialization makes this slow. Keeping a minimum number of instances warm removes startup latency for baseline traffic, and allocating CPU outside requests lets those instances maintain connection pools. The service can still scale to the maximum instance count during peaks, so cost stays proportional to actual demand beyond the warm baseline.

Answer

Enable Cloud CDN for the Cloud Run service and set a long cache TTL for order-processing responses.

Answer

Move the service to a GKE cluster with cluster autoscaling and a horizontal pod autoscaler.

Answer

Increase the maximum number of instances and set the container concurrency to one.

Question 5

A financial services firm is deploying a three-tier application on Google Cloud. The web tier runs on managed instance groups behind an external HTTP(S) load balancer, the application tier runs on GKE, and the database tier runs on Cloud SQL. Security requires that the database tier accept connections only from the application tier and that no component be reachable from the public internet except the web tier. The architect must design the network and firewall configuration. (Choose two.)

Accepted Answer

Deploy the GKE cluster with private nodes and use a VPC-native cluster so pods receive IP addresses from a secondary range in the VPC.. Private connectivity plus precise firewall scoping achieves the required segmentation. Giving Cloud SQL a private IP and allowing only the GKE pods' secondary range on the database port ensures the application tier alone reaches the database. Making the GKE cluster VPC-native with private nodes gives pods routable VPC addresses and removes node external IPs, so only the web tier behind the load balancer is internet-facing. Together these satisfy both constraints.

Answer

Place the web tier and application tier in the same subnet and use a single firewall rule that allows all internal traffic between them to simplify management.

Answer

Attach an external IP to each GKE node and rely on Kubernetes NetworkPolicy to block inbound traffic from the internet.

Answer

Configure the Cloud SQL instance with a public IP and add authorized networks for the GKE node external IPs so the application tier can connect.

Question 6

Your organization requires that all production changes to Google Cloud resources be auditable and that you can identify who made a change and when. You need to configure logging to meet this requirement. What should you do?

Accepted Answer

Enable Admin Activity audit logs, which are enabled by default, and export them to a centralized logging project or Cloud Storage bucket with retention policies.. Admin Activity audit logs are enabled by default and record administrative changes, including the identity of the caller and the timestamp. Exporting these logs to a centralized project or Cloud Storage with retention policies ensures they are preserved for auditing. This satisfies the requirement to audit production changes.

Answer

Configure VPC Flow Logs to capture network traffic and analyze it for unauthorized changes.

Answer

Enable Data Access audit logs for all services and export them to Cloud Storage for long-term retention.

Answer

Use Cloud Monitoring to create alerting policies for resource changes and send notifications to a team email.

Question 7

Your company is designing a new application on Google Cloud. The security team requires that all data at rest be encrypted with customer-managed encryption keys (CMEK) and that access to these keys be audited. You need to implement a solution that meets these requirements. (Choose two.)

Accepted Answer

Use Cloud KMS to create a key ring and crypto key, and grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the service account used by the application.. Using Cloud KMS to create and manage CMEK, and granting the application's service account the CryptoKey Encrypter/Decrypter role, ensures data is encrypted with customer-managed keys. Enabling Cloud Audit Logs for Cloud KMS and exporting them to a central project provides the required auditing of key access. Together, these meet the security requirements.

Answer

Enable VPC Service Controls to restrict access to Cloud KMS resources.

Answer

Use customer-supplied encryption keys (CSEK) for all Google Cloud services that support them.

Answer

Configure default encryption at rest using Google-managed encryption keys for all services.

Question 8

A retail company runs a stateful batch application on a managed instance group. The application writes intermediate results to the boot disk of each VM and takes several hours to complete. The operations team wants rolling updates that replace instances with a new image, but must guarantee that no in-flight job is interrupted. Which configuration should you recommend?

Accepted Answer

Use stateful managed instance group configuration with a replacement policy, and set the update type to opportunistic so instances are only replaced when you deliberately delete them.. A stateful managed instance group combined with an opportunistic update gives the operations team explicit control over when each instance is replaced. Because replacements occur only when an instance is deliberately deleted or recreated, the team can wait for each batch job to finish, update the image on the template, and then replace instances one at a time without interrupting work.

Answer

Set the update type to proactive, configure a maximum surge, and rely on the managed instance group's health checks to drain connections.

Answer

Convert the workload to a regional managed instance group and enable autoscaling based on CPU utilization during the rollout.

Answer

Set the update type to opportunistic and rely on the instance template's automatic restart policy.

Question 9

A financial services company runs a high-volume transaction processing system on Google Cloud. They need to ensure that the system can handle sudden spikes in traffic during market open and close. The system uses a managed instance group of Compute Engine VMs behind a load balancer. They want to optimize costs while maintaining performance during peak hours. Which approach should the architect recommend?

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization, and set a minimum size to handle baseline traffic.. Autoscaling based on CPU utilization with a minimum instance count provides elasticity to handle traffic spikes while ensuring baseline capacity. This allows the system to scale out during market open and close and scale in during quieter periods, optimizing costs without sacrificing performance. Other options either over-provision, use unreliable preemptible VMs, or risk cold starts.

Answer

Use preemptible VMs in the managed instance group to reduce compute costs.

Answer

Use a managed instance group with autoscaling based on a custom metric that tracks queue depth, and set a minimum size of zero.

Answer

Use a managed instance group with a fixed size large enough to handle peak traffic at all times.

Question 10

A global e-commerce company is designing its application architecture on Google Cloud. The application must serve users from multiple regions with low latency and must be able to fail over between regions automatically in case of a regional outage. The company wants to minimize operational overhead and ensure that the database layer supports multi-region writes with strong consistency. Which database solution should they choose?

Accepted Answer

Cloud Spanner with a multi-region configuration.. Cloud Spanner is the only Google Cloud database that offers multi-region writes with strong consistency and automatic failover. It is designed for global applications requiring low latency and high availability. The other options either do not support multi-region writes or do not provide strong consistency across regions.

Answer

Cloud SQL for PostgreSQL with cross-region read replicas.

Answer

Cloud Bigtable with a multi-region cluster.

Answer

Firestore in Datastore mode with multi-region replication.

Question 11

A retail company runs a customer-facing API on a managed instance group (MIG) of Compute Engine VMs behind an external Application Load Balancer. The SRE team wants the load balancer to stop sending traffic to a VM as soon as the local application health endpoint starts returning HTTP 500, even before the VM is fully unresponsive. Which load balancer component must be configured to achieve this?

Accepted Answer

Configure an HTTP health check with a check interval and unhealthy threshold on the backend service, and attach it to the MIG.. For an external Application Load Balancer, the backend service's health check is the mechanism that determines which instances receive traffic. By pointing an HTTP health check at the application's health endpoint, a VM that begins returning HTTP 500 is marked unhealthy once the unhealthy threshold is met and is removed from rotation, so users are not routed to a failing instance while it is still alive.

Answer

Set the MIG's autoscaling policy to scale in when CPU utilization drops below a target threshold.

Answer

Enable Cloud CDN on the backend service so that failing responses are cached and served from edge locations.

Answer

Create an uptime check in Cloud Monitoring against the API endpoint and rely on its alerting policy to failover.

Question 12

A company runs a high-traffic web application on Google Kubernetes Engine (GKE). The application uses a Cloud SQL for MySQL instance as its backend. The operations team wants to optimize the cost of the GKE cluster and the Cloud SQL instance without sacrificing performance or availability. Which two actions should they take? (Choose two.)

Accepted Answer

Purchase committed use discounts for the GKE nodes' underlying Compute Engine instances.. Enabling cluster autoscaler ensures the GKE cluster scales dynamically with demand, reducing costs during idle periods while maintaining performance. Purchasing committed use discounts for the underlying Compute Engine instances provides cost savings for the baseline load. Together, these actions optimize costs without compromising performance or availability.

Answer

Use preemptible VMs for the GKE nodes to reduce compute costs.

Answer

Configure Cloud SQL to use a shared-core machine type to reduce database costs.

Answer

Schedule regular backups of the Cloud SQL instance to reduce storage costs.

Question 13

Your company runs a microservices application on GKE. The development team wants to adopt a progressive delivery strategy to reduce the risk of new releases. They need to route a small percentage of production traffic to a new version, monitor key metrics, and automatically roll back if errors increase. Which approach should you recommend?

Accepted Answer

Implement a canary deployment using Istio with traffic splitting and Prometheus-based analysis.. A canary deployment with Istio allows you to route a small percentage of traffic to the new version and monitor metrics. Prometheus can feed analysis into an automated process that rolls back if error rates exceed a threshold. This provides the progressive delivery and automated risk mitigation the team needs, unlike blue/green, rolling updates, or basic Ingress.

Answer

Configure a rolling update on the Kubernetes Deployment with a maxSurge and maxUnavailable setting.

Answer

Use a blue/green deployment by creating a full second environment and switching all traffic at once after testing.

Answer

Deploy the new version to a separate namespace and use a Kubernetes Ingress with weight-based routing.

Question 14

A retail company runs its order-processing platform on Compute Engine instances in a single managed instance group (MIG) spread across three zones in us-central1. During seasonal peaks, the application must handle up to 10x normal traffic while keeping median request latency under 200 ms. The architecture team wants to add a caching layer that can absorb repeated catalogue reads and survive the loss of an entire zone without manual intervention. Which design should they choose?

Accepted Answer

Deploy Memorystore for Redis in Standard Tier with a replica in a second zone and configure the application to read from the Redis endpoint.. The requirement combines zone-level resilience, low-latency repeated reads, and no manual failover. A managed in-memory cache with automatic cross-zone replication satisfies all three simultaneously: replication handles the zone loss, in-memory storage handles the latency, and the managed endpoint removes manual steps. Options that lack a replica or that push orchestration onto the team fail at least one stated constraint, and edge HTTP caching does not fit dynamic internal reads.

Answer

Deploy Memorystore for Redis in Basic Tier and place the instance in the same zone as the majority of the MIG instances to reduce network latency.

Answer

Deploy a self-managed Redis cluster on Compute Engine instances distributed across three zones and manage replication and failover with your own scripts.

Answer

Enable Cloud CDN with a backend service pointed at the MIG, and rely on edge caching to serve repeated catalogue reads.

Question 15

You are responsible for a Cloud Run service that experiences occasional cold starts, causing increased latency. You want to minimize cold starts while keeping costs under control. What should you do?

Accepted Answer

Set the minimum number of instances to a value greater than zero.. To minimize cold starts in Cloud Run, set the minimum number of instances to a value greater than zero. This keeps a baseline of warm instances ready to serve requests, reducing latency. Increasing the maximum instances or CPU limit does not prevent cold starts, and a larger container image would exacerbate them.

Answer

Increase the maximum number of instances.

Answer

Use a larger container image.

Answer

Deploy the service with a higher CPU limit.

Question 16

A logistics company runs a batch route-optimization job that reads 50 TB from Cloud Storage, performs CPU-intensive computation, and writes results back to Cloud Storage. The job runs for about four hours each night and must finish before the morning dispatch window. The team wants the lowest cost while guaranteeing completion within the window. Which compute design should the architect choose?

Accepted Answer

A Batch job with a task group that specifies a machine type and a maximum run duration, using standard provisioning. Batch is the managed service for running containerized batch workloads on Compute Engine. Specifying a task group with standard provisioning and a maximum run duration guarantees capacity for the four-hour job, and Batch handles Cloud Storage staging, retries, and job lifecycle. Preemptible options risk termination, Dataproc targets Spark and Hadoop, and Cloud Run timeouts prevent long-running jobs.

Answer

A managed instance group of preemptible VMs with an instance template that runs the batch job

Answer

A Cloud Run service with 8 vCPU and 32 GiB memory processing the job on a nightly Cloud Scheduler trigger

Answer

A Dataproc cluster with autoscaling enabled and secondary workers on preemptible VMs

Question 17

A retail company is planning a Google Cloud organization structure for a new e-commerce platform. They want to isolate production from non-production, allow central network and security teams to apply guardrails across all projects, and give application teams self-service within their own boundaries. Which two design choices support these goals? (Choose two.)

Accepted Answer

Use a Shared VPC host project owned by the central network team, with application projects attached as service projects.. A folder hierarchy with production and non-production branches lets central teams apply organization policies and IAM that inherit downward, while application teams create projects inside their assigned folder. Pairing that with a Shared VPC host project centralizes network control and lets service projects consume the network, so application teams get self-service deployment without owning network topology.

Answer

Place every project directly under the organization node and manage IAM individually per project.

Answer

Assign each application team the Project Creator role at the organization node so they can create projects anywhere.

Answer

Grant the central network team the Organization Administrator role so they can manage all projects directly.

Question 18

Your organization is adopting Google Cloud and wants to establish a cost governance framework. You need to implement mechanisms that provide visibility into spending and allow proactive control over costs. (Choose two.)

Accepted Answer

Set up budget alerts in Cloud Billing to notify stakeholders when spending exceeds a defined threshold.. Cost governance requires both visibility and proactive control. Exporting billing data to BigQuery with Looker Studio dashboards provides deep visibility into spending patterns, while budget alerts notify stakeholders when thresholds are breached. Together, they enable analysis and timely intervention. The other options are either optimization tactics, overly broad permissions, or planning tools that lack ongoing monitoring.

Answer

Assign the Billing Account Administrator role to all project owners to ensure they can view and manage costs.

Answer

Use the Pricing Calculator to estimate costs before deploying new resources.

Answer

Enable committed use discounts for all Compute Engine instances to reduce the effective cost per hour.

Question 19

A media company runs a batch transcoding pipeline on Google Kubernetes Engine. Jobs read input from a Cloud Storage bucket and write output to a second bucket. The team wants the pipeline to keep processing through transient Cloud Storage 429 and 503 errors without losing work, and they want the pods to stop being killed mid-job during node upgrades. Which combination should the architect implement?

Accepted Answer

Add exponential backoff retries with jitter in the application's Cloud Storage client, and configure a PodDisruptionBudget for the job pods.. Reliability for this pipeline requires handling transient Cloud Storage errors at the client layer and protecting pods from simultaneous voluntary disruption. Exponential backoff with jitter retries 429 and 503 responses without overwhelming the service, while a PodDisruptionBudget constrains how many job pods are evicted during node upgrades, letting the pipeline drain gracefully instead of losing work.

Answer

Increase the Cloud Storage bucket's requester pays setting and enable Object Versioning on both buckets.

Answer

Move the pipeline to a DaemonSet so one pod runs on every node and is not subject to eviction.

Answer

Set the pods' restartPolicy to Always and rely on the default pod eviction behavior during node upgrades.

Question 20

Your company has a complex legacy application that runs on a single large VM. The application is stateful and has a monolithic architecture. You are tasked with migrating it to Google Cloud with minimal changes, but you also want to improve its reliability and scalability over time. Which migration strategy should you initially recommend?

Accepted Answer

Rehost the application by moving the VM to Compute Engine using Migrate for Compute Engine.. Rehosting with Migrate for Compute Engine allows you to move the VM to Compute Engine with minimal changes, satisfying the immediate requirement. Once in the cloud, you can take advantage of reliability features like snapshots and managed instance groups, and later consider refactoring or replatforming. The other strategies involve significant changes or replacements that contradict the minimal-change constraint.

Answer

Refactor the application into microservices on GKE to improve scalability and reliability.

Answer

Replatform the application by moving it to a managed database service and modifying the code to use cloud-native APIs.

Answer

Repurchase by replacing the application with a SaaS solution that provides similar functionality.