Google PCA Practice Exam 55 — 20 Questions

Question 1

A cloud architect needs to implement a CI/CD pipeline for a team developing a Python-based microservice. The team uses GitHub as their source repository. The pipeline should automatically run unit tests and deploy the service to Cloud Run when changes are pushed to the main branch. Which THREE Google Cloud services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Artifact Registry. Cloud Build can connect to GitHub via triggers to run tests and build a container image. Artifact Registry stores the image. Cloud Run deploys the container. Cloud Deploy is for GKE and other platforms, not Cloud Run directly. Cloud Functions is serverless but not for containers. Cloud Source Repositories is Google's own git, not GitHub.

Answer

Cloud Deploy

Answer

Cloud Source Repositories

Question 2

A company wants to migrate an on-premises Oracle database to Google Cloud. They need high availability and want to minimize application changes. Which service should they use?

Accepted Answer

Bare Metal Solution. Bare Metal Solution is correct because it provides dedicated physical servers for Oracle workloads, enabling high availability through Oracle RAC or Data Guard while preserving the existing Oracle database architecture. This minimizes application changes since the database remains Oracle-native, unlike managed services that require migration to a different database engine.

Answer

Cloud SQL for MySQL

Answer

Cloud Spanner

Answer

Compute Engine with Oracle license

Question 3

A company runs a monolithic application on Compute Engine. They want to modernize by moving to microservices on Google Kubernetes Engine (GKE) to improve deployment frequency and resource utilization. However, they are concerned about the increased operational complexity. Which approach best balances modernization benefits with operational overhead?

Accepted Answer

Identify stateless components to migrate to Cloud Run, and keep stateful components on GKE with managed services like Cloud Spanner.. It pragmatically balances modernization benefits with operational overhead by migrating only stateless components to Cloud Run (a fully managed serverless platform that reduces operational complexity) while keeping stateful components on GKE with managed services like Cloud Spanner. This approach improves deployment frequency and resource utilization without requiring a full rewrite, and it leverages Cloud Run's automatic scaling and zero infrastructure management to minimize operational burden.

Answer

Keep the monolithic application on Compute Engine and use Cloud Monitoring to optimize resource utilization.

Answer

Migrate all application components to Cloud Run and use Cloud Tasks for asynchronous communication.

Answer

Rewrite the entire application as microservices and deploy on GKE with Istio for service mesh.

Question 4

An organization is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single server with an on-premises database. The application is stateful and requires low-latency access to the database. The migration must minimize downtime and ensure high availability. Which architecture should the company adopt?

Accepted Answer

Deploy on Compute Engine with a regional persistent disk and use Cloud SQL for PostgreSQL with regional high availability.. It combines Compute Engine with a regional persistent disk for synchronous replication across zones, ensuring high availability with minimal downtime during a zonal failure. Cloud SQL for PostgreSQL with regional high availability provides a managed, low-latency database with automatic failover, meeting the stateful application's need for low-latency access and high availability without the complexity of container orchestration.

Answer

Deploy on GKE with StatefulSets and use Cloud Spanner for global consistency.

Answer

Deploy on App Engine Standard Environment and use Cloud Firestore in Datastore mode.

Answer

Deploy on Cloud Run and use Cloud SQL with read replicas.

Question 5

An organization has a multi-regional deployment of a stateful application on GKE using regional persistent disks. They need to implement disaster recovery with an RPO of less than 1 hour and RTO of 30 minutes. What is the most cost-effective approach?

Accepted Answer

Use regional persistent disks with asynchronous replication to a secondary region and deploy GKE clusters in both regions with a load balancer directing traffic.. Regional persistent disks with asynchronous replication provide built-in, managed replication to a secondary region, meeting the RPO of less than 1 hour and RTO of 30 minutes without additional infrastructure costs. By deploying GKE clusters in both regions and using a load balancer, traffic can be redirected to the secondary cluster within the RTO, making this the most cost-effective approach as it avoids third-party tools or complex manual processes.

Answer

Use zonal persistent disks and take snapshots every 45 minutes, then restore in secondary region.

Answer

Use a third-party replication tool to asynchronously replicate data to the secondary region.

Answer

Use Cloud Storage FUSE to write state to a multi-regional bucket and read from secondary cluster.

Question 6

A company uses Cloud Deployment Manager to manage infrastructure. They want to roll back to a previous deployment state after a failed update. What is the recommended approach?

Accepted Answer

Run gcloud deployment-manager deployments update --config <previous_manifest>. Deployment Manager stores the deployment manifests. You can use an update with a previous manifest to revert to a known good state. Deleting and recreating is not a rollback. Partial updates are not supported directly.

Answer

Use gcloud deployment-manager deployments rollback --deployment <name>

Answer

Use the --update-policy=PARTIAL flag to selectively revert changes

Answer

Delete the deployment and recreate it from the previous template

Question 7

A company commits to using Compute Engine for 3 years and wants the maximum discount. Which purchasing option should they use?

Accepted Answer

3-year committed use discount.. A 3-year committed use discount (CUD) offers the highest discount rate (up to 57% for most machine types) compared to 1-year CUDs (up to 37%) or pay-as-you-go pricing. By committing to a consistent resource usage for the full 3-year term, the company maximizes the discount on Compute Engine costs.

Answer

Pay-as-you-go pricing.

Answer

Sustained use discounts.

Answer

1-year committed use discount.

Question 8

An administrator creates a GKE cluster with the command above. After deployment, the cluster has 3 nodes, but the node pool autoscaler never scales up even under load. What is the most likely reason?

Accepted Answer

The cluster is zonal, but node locations include multiple zones.. The node pool autoscaler in GKE cannot scale up a cluster that uses multiple zones in a single zonal cluster. The autoscaler requires that all nodes in the pool be in the same zone to properly manage capacity; when node locations span multiple zones in a zonal cluster, the autoscaler is disabled and will not trigger scaling events, even under load.

Answer

The autoscaler minimum nodes is set to 1 and maximum to 5.

Answer

The disk size of 100 GB is insufficient.

Answer

The machine type e2-medium is too small for the workloads.

Question 9

Company B uses Cloud Endpoints to expose their API. Recently, they started seeing 503 errors during periods of high traffic. They have enabled Cloud Endpoints with a moderate quota. The backend is running on Cloud Run. The Cloud Run service is configured with min instances = 0 and max instances = 100. The container concurrency is set to 80. The average request latency is 200ms. What is the most likely cause and what should they do?

Accepted Answer

Cloud Run is scaling too slowly; set min instances to a higher value.. The 503 errors during high traffic are most likely caused by Cloud Run's scaling latency. With min instances = 0, new requests must wait for a container to start (cold start), and during traffic spikes, the scaling algorithm may not provision instances quickly enough, leading to request timeouts and 503s. Setting a higher min instances value ensures a warm pool of containers is always ready to handle traffic bursts, reducing cold start delays.

Answer

The container concurrency is too low; increase it to 200.

Answer

The backend is experiencing cold starts; set a higher CPU limit.

Answer

The Cloud Endpoints quota is being exhausted; increase the quota.

Question 10

A company is designing a DR strategy for their GKE workloads. They need to back up application data and cluster configuration. Which THREE resources should they include in their backup plan? (Choose THREE.)

Accepted Answer

etcd snapshot via Velero. PersistentVolume data (application data), Kubernetes resource manifests (deployments, services), and etcd snapshots (cluster state) are essential. Node images can be recreated from configuration. Service accounts are IAM entities and not typically backed up as part of cluster backup.

Answer

Service account keys for the cluster

Answer

Compute Engine node images

Question 11

An organization wants to enforce a policy that prohibits the creation of Cloud Storage buckets with uniform bucket-level access disabled. What should they use?

Accepted Answer

Organization policy with a list constraint.. Organization policies can enforce constraints like constraints/storage.uniformBucketLevelAccess to require uniform bucket-level access. Option B (IAM roles with custom permissions) cannot deny bucket creation with specific settings. Option C (Cloud Audit Logs) is for logging, not enforcement. Option D (Cloud Armor) is for security policies at the edge.

Answer

IAM roles with custom permissions to deny bucket creation.

Answer

Cloud Audit Logs to monitor bucket creation.

Answer

Cloud Armor security policies.

Question 12

Drag and drop the steps to configure IAM roles for a service account to access Cloud Storage from a Compute Engine instance into the correct order.

Accepted Answer

Create the service account, then grant the necessary IAM roles, then attach the service account to the Compute Engine instance.. The service account must be attached to the instance before it can be used. Granting roles is done on the service account.

Answer

Grant the necessary IAM roles, then attach the service account to the Compute Engine instance, then create the service account.

Answer

Attach the service account to the Compute Engine instance, then create the service account, then grant the necessary IAM roles.

Answer

Create the service account, then attach it to the Compute Engine instance, then grant the necessary IAM roles.

Question 13

A startup wants to grant a new employee read-only access to view all Compute Engine instances in a project. What is the minimum IAM role they should assign?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list and view instances, without allowing modifications. This is the minimum IAM role that satisfies the requirement for read-only access to all Compute Engine instances in a project, as it provides the necessary permissions (e.g., compute.instances.list, compute.instances.get) without granting broader project-level or write permissions.

Answer

roles/owner

Answer

roles/iam.securityReviewer

Answer

roles/compute.admin

Question 14

A company is using Cloud Load Balancing to expose a web application. They want to protect against common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides Web Application Firewall (WAF) capabilities that can inspect HTTP/HTTPS traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with Cloud Load Balancing to apply pre-configured or custom rules at the edge, blocking malicious requests before they reach the backend.

Answer

VPC Firewall rules

Answer

Identity-Aware Proxy

Answer

Cloud CDN

Question 15

A company wants to ensure that all access to their Cloud Storage bucket is logged for compliance purposes. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs (Option B) are required to log every API call that reads, writes, or deletes data in a Cloud Storage bucket, such as object GETs and PUTs. Admin Activity logs only record configuration changes, not data access, so they would not capture the read/write operations needed for compliance logging.

Answer

Admin Activity audit logs

Answer

System Event audit logs

Answer

Access Transparency logs

Question 16

A company runs a Kubernetes cluster on GKE. They need to ensure that pods cannot access Google Cloud APIs unless explicitly allowed through a service account. Which GKE feature should they use?

Accepted Answer

Workload Identity. Workload Identity is the correct choice because it allows pods in GKE to authenticate to Google Cloud APIs using a specific Google service account, rather than the default Compute Engine service account. This ensures that pods cannot access any Google Cloud APIs unless explicitly granted permission via IAM roles bound to that service account, meeting the requirement for least-privilege access.

Answer

Network Policies

Answer

Pod Security Policies

Answer

Cloud Audit Logs

Question 17

An organization is running a stateful workload on Compute Engine with a single persistent disk. They want to migrate to a regional persistent disk for higher availability. The disk is 500 GB and currently 80% full. They need zero downtime during the migration. What is the recommended approach?

Accepted Answer

Create a snapshot of the disk, then create a new regional persistent disk from that snapshot, and attach it to the instance.. Creating a snapshot of the existing persistent disk and then creating a new regional persistent disk from that snapshot allows you to attach the new disk to the instance with zero downtime. The snapshot captures the disk state at a point in time, and the regional disk is created asynchronously; once available, you can detach the original disk and attach the regional disk without stopping the instance, as Compute Engine supports live disk attachment/detachment.

Answer

Attach a new regional disk to the instance and use RAID 1 mirroring.

Answer

Use rsync to copy data to a new regional disk while the instance is running.

Answer

Use gcloud compute disks resize to change the disk type to regional.

Question 18

Which TWO of the following are valid methods to enforce data residency at rest in Google Cloud?

Accepted Answer

Set bucket locations at creation time and use Object Lifecycle Management to prevent cross-region replication.. Setting bucket locations at creation time and using Object Lifecycle Management to prevent cross-region replication ensures that data is stored only in the specified region and cannot be moved or replicated to another region. This directly enforces data residency at rest by controlling where the data physically resides within Google Cloud Storage.

Answer

Use a VPC Service Controls perimeter with restricted API access.

Answer

Use Cloud VPN to encrypt data in transit.

Answer

Enable Data Loss Prevention (DLP) API to mask sensitive data.

Question 19

An e-commerce company uses Cloud SQL for MySQL for its transactional database. They need to run complex analytical queries on the same data without impacting OLTP performance. The analytical queries should be run on a read replica with minimal lag. Which solution is BEST?

Accepted Answer

Create a Cloud SQL read replica and run analytical queries on it. Creating a Cloud SQL read replica allows you to offload analytical queries to a separate instance that replicates from the primary using MySQL's native asynchronous replication. This isolates the OLTP workload from heavy analytical queries, and with proper configuration (e.g., using a higher machine type and enabling InnoDB buffer pool tuning on the replica), you can achieve minimal replication lag. The read replica supports the same MySQL engine, so complex analytical queries run without schema changes or data movement.

Answer

Use Data Studio directly on Cloud SQL primary instance

Answer

Migrate to Cloud Spanner to handle both workloads

Answer

Export the database to BigQuery and run queries there

Question 20

A security team needs to restrict access to a set of Cloud Storage buckets so that only Compute Engine instances with a specific service account can read objects. Which TWO steps should they take? (Choose two.)

Accepted Answer

Grant the service account the 'roles/storage.objectViewer' role on the bucket. To restrict access to Cloud Storage buckets so that only Compute Engine instances with a specific service account can read objects, the correct approach is to use IAM permissions (option A) to grant the service account the 'roles/storage.objectViewer' role, and VPC Service Controls (option C) to create a perimeter that limits access to the VPC where the instances reside. IAM defines who can access resources, while VPC Service Controls enforce network-based boundaries. Firewall rules (option E) are not applicable to Cloud Storage access, as Cloud Storage is a global service accessed via HTTPS, not via IP ranges.

Answer

Grant the user who owns the instances the 'roles/storage.admin' role

Answer

Create a bucket ACL that allows read access for the service account

Answer

Add a firewall rule allowing ingress from the service account to the bucket's IP range