Google PCA Practice Exam 56 — 20 Questions

Question 1

An application uses Cloud SQL (PostgreSQL) and experiences high connection overhead, often exhausting the max connections limit. The team wants to maintain a pool of persistent connections without modifying application code. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy PgBouncer on a Compute Engine instance. PgBouncer is a connection pooler for PostgreSQL that manages a pool of connections, reducing overhead and preventing exhaustion. It can be deployed on Compute Engine or using Cloud SQL Auth Proxy with connection pooling.

Answer

Use Cloud Memorystore as a connection cache

Answer

Increase the max connections flag in Cloud SQL

Answer

Configure Cloud SQL Auth Proxy with max connections

Question 2

A company is using Cloud Load Balancing to distribute traffic to a managed instance group (MIG) of web servers. The web servers are currently running in us-central1. To improve availability, the company plans to add a second MIG in us-west1. What must be done to ensure traffic is automatically routed to the closest healthy backend?

Accepted Answer

Use a global external HTTP(S) load balancer and add both MIGs as backends.. A global external HTTP(S) load balancer can route traffic to backends in multiple regions and automatically directs requests to the closest healthy backend based on the client's geographic location and backend health. Adding both MIGs as backends to this single anycast IP ensures traffic is distributed to the nearest region without additional DNS-based routing or redirects.

Answer

Use a Network Load Balancer in us-central1 and configure a redirect to the new MIG.

Answer

Use an internal TCP/UDP load balancer in each region and configure DNS-based routing.

Answer

Use an external TCP/UDP Network Load Balancer with the new MIG as an additional backend.

Question 3

A security architect is designing a zero-trust network for applications running on Compute Engine. They want to enforce that all traffic between VMs must be encrypted and authenticated, regardless of the VPC network. Which approach meets this requirement?

Accepted Answer

Deploy Anthos Service Mesh with mTLS enabled.. Anthos Service Mesh with mTLS (mutual TLS) encrypts and authenticates all traffic between workloads at the application layer, regardless of the underlying VPC network. This meets the zero-trust requirement because mTLS ensures both encryption and mutual authentication for every request, without needing to manage per-VM tunnels or rely on network-layer constructs.

Answer

Configure each VM to use IPsec tunnels to every other VM.

Answer

Use Cloud VPN to encrypt all inter-VM traffic.

Answer

Enable VPC Flow Logs and use firewall rules to allow only encrypted traffic.

Question 4

A company is migrating a 200 TB on-premises file server to Cloud Storage. The network bandwidth is limited to 100 Mbps. The migration must complete within 30 days. Which approach should they use?

Accepted Answer

Use Transfer Appliance. Transfer Appliance is a physical device that can transfer up to 480 TB in a single shipment. At 100 Mbps, transferring 200 TB over the network would take approximately 200 TB * 1024 GB/TB * 8 bits/byte / (100 Mbps) = 1,638,400 Gb / 0.1 Gbps = 16,384,000 seconds ≈ 190 days, far exceeding 30 days. Therefore, using Transfer Appliance is the only feasible option.

Answer

Use Storage Transfer Service from another cloud

Answer

Use gsutil rsync over the network

Answer

Use Cloud Data Fusion

Question 5

A company uses Cloud Storage for backup data. They want to protect against accidental deletion. Which option is best?

Accepted Answer

Enable object versioning.. Object versioning in Cloud Storage preserves every version of an object, including overwrites and deletions. When versioning is enabled, a delete operation creates a delete marker instead of permanently removing the object, allowing easy recovery. This directly protects against accidental deletion by retaining all previous object versions.

Answer

Use a lifecycle policy.

Answer

Set a retention policy.

Answer

Use object holds.

Question 6

A large e-commerce company runs its production workloads on Google Cloud. The security team has implemented a VPC Service Controls perimeter around the production project to prevent data exfiltration. The perimeter includes the project, and access is allowed only from an access level that requires the user to be on the corporate network (192.0.2.0/24). Recently, the DevOps team reported that their CI/CD pipeline, which runs on Cloud Build with a VPC connector attached to a shared VPC in a different project, is failing to deploy to Cloud Run. The pipeline uses a service account with roles/run.admin on the production project. The Cloud Build worker IPs are ephemeral and not in the corporate IP range. The pipeline's deployment step times out with permission errors. Which action will resolve the issue while maintaining security compliance?

Accepted Answer

Add the Cloud Build service account as a member of the access level used in the perimeter, so that it is not restricted by IP.. Adding the Cloud Build service account as a member of the access level allows it to bypass the IP restriction. In VPC Service Controls, access levels can include both IP conditions and members. By adding the service account as a member, the perimeter still enforces IP restrictions for other users, but the service account is allowed through based on its identity, not its IP. This resolves the deployment failure while maintaining the security perimeter. Option B is wrong because removing the perimeter defeats the security requirement. Option C is wrong because adding 0.0.0.0/0 would allow all IPs, weakening security. Option D is wrong because changing the service account does not change the ephemeral nature of the Cloud Build worker IPs; the permission error is due to IP restriction, not IAM roles.

Answer

Remove the VPC Service Controls perimeter from the production project and rely solely on IAM permissions.

Answer

Add the Cloud Build worker IP range (0.0.0.0/0) to the access level's IP condition to allow all IPs.

Answer

Create a new service account for Cloud Build with roles/iam.serviceAccountUser and roles/run.admin, and assign it to the Cloud Run service.

Question 7

Your team has deployed a microservices application on Google Kubernetes Engine (GKE) with multiple services communicating via internal ClusterIP services. You notice that some requests between services are failing intermittently with 'connection refused' errors. The services are defined with readiness probes. What is the most likely cause?

Accepted Answer

The readiness probes are not passing, causing the service endpoints to be removed.. The 'connection refused' error indicates that the client is attempting to connect to a port on which no process is listening. In GKE, when a readiness probe fails, Kubernetes removes the pod's IP from the corresponding ClusterIP service's endpoints. If all pods for a service fail their readiness probes, the service has no healthy endpoints, and any request to the ClusterIP will be refused because there is no backend to accept the connection. This matches the intermittent nature of the issue, as pods may temporarily fail the probe and then recover.

Answer

The services are not exposed via a VPC peering connection to the client's VPC.

Answer

The services are using NodePort instead of LoadBalancer type, causing port conflicts.

Answer

The services are not associated with an Ingress resource.

Question 8

A company is using Cloud Functions (2nd gen) for event-driven processing of uploaded images in Cloud Storage. Each image is resized to multiple sizes and stored back in different buckets. Recently, the number of uploads has increased 10x, and the team notices that some images are not being processed, and logs show function execution timeouts after 60 seconds. The function's timeout is set to 60 seconds. The code processes images sequentially. The team needs to reliably process all images with minimal code changes. What should they do?

Accepted Answer

Use Cloud Tasks to queue the processing and run the function as a task handler.. Use Cloud Tasks to queue the processing and run the function as a task handler. This decouples the image processing from the upload event, allowing retries and better scalability. Cloud Tasks can handle the increased load and provide reliable execution with built-in retries. Option A (increase memory) may improve performance but does not address the timeout issue when processing multiple images sequentially. Option C (increase timeout to 540 seconds) would merely extend the timeout window but still risks timeouts and does not scale. Option D (split into separate functions) increases complexity and requires significant code changes without addressing the fundamental sequential processing bottleneck.

Answer

Increase the memory allocation for the function.

Answer

Increase the Cloud Function timeout to 540 seconds.

Answer

Split the function into separate functions for each resize operation.

Question 9

A company has multiple GCP projects under a folder. They want to define a custom IAM role that can be reused across all projects. Where should the custom role be defined?

Accepted Answer

At the folder level. Custom roles can be defined at the organization level, folder level, or project level. To reuse across all projects, the role should be defined at the organization level or at the folder level if the folder contains all projects.

Answer

At the project level

Answer

At the organization level

Answer

At the resource level

Question 10

A global e-commerce platform is experiencing intermittent latency spikes during flash sales. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster. The architecture includes a frontend service, a product catalog service using Cloud Spanner, and an order processing service using Cloud Pub/Sub. During high load, the catalog service shows increased query latency, and some requests time out. What should the architect prioritize to address the issue?

Accepted Answer

Enable Cloud Spanner interleaved tables and add secondary indexes for common query filters.. The issue is specifically with Cloud Spanner query latency under high load. Enabling interleaved tables and adding secondary indexes optimizes data locality and query performance, reducing the need for expensive cross-table joins and full table scans. This directly addresses the root cause of increased latency and timeouts in the catalog service.

Answer

Use Cloud CDN to cache product catalog responses.

Answer

Increase the number of nodes in the GKE node pool.

Answer

Migrate the catalog service from Cloud Spanner to Cloud Bigtable for better read performance.

Question 11

Match each GCP migration term to its description.

Accepted Answer

Migrate for Compute Engine: Migrates virtual machines to Compute Engine with minimal downtime.. Correct matches: Migrate for Compute Engine migrates VMs; Cloud Storage Transfer Service handles online data transfers; Transfer Appliance is a physical device for large datasets; Database Migration Service migrates databases to Cloud SQL. Common confusions include swapping the roles of these services.

Answer

Migrate for Compute Engine: Transfers data from online sources to Cloud Storage.

Answer

Cloud Storage Transfer Service: Physical device to transfer large datasets to Google Cloud.

Question 12

A developer needs to grant a Compute Engine instance the ability to read from a Cloud Storage bucket. The instance does not have a service account attached. What should the developer do?

Accepted Answer

Create a service account and assign it the Storage Object Viewer role, then attach the service account to the instance.. The best practice is to create a service account with the required roles (e.g., Storage Object Viewer) and attach it to the instance. This avoids managing keys and follows IAM best practices.

Answer

Add the instance's external IP to the bucket permissions.

Answer

Generate a JSON key for a user account and store it on the instance.

Answer

Create a firewall rule to allow access to Cloud Storage.

Question 13

Match each GCP compute service to its characteristic.

Accepted Answer

Compute Engine: Virtual machines on demand, IaaS.. Compute Engine provides IaaS virtual machines; GKE offers managed Kubernetes; Cloud Run enables serverless containers; App Engine is a PaaS for web apps. Common confusions include mixing serverless and Kubernetes features.

Answer

Compute Engine: Managed Kubernetes clusters.

Answer

Google Kubernetes Engine: Serverless container execution.

Answer

Cloud Run: PaaS for web apps with auto-scaling.

Question 14

A developer runs the command above and sees the output. The cluster has one node pool with 3 nodes, each of type e2-standard-4 (4 vCPU, 16 GB RAM). The application requires at least 2 GB of memory per pod and the cluster has 10 pods that need to be scheduled. The developer also notices that the node pool autoscaling is enabled with a minimum of 1 and maximum of 5 nodes. However, the cluster is unable to schedule all pods. What is the most likely cause?

Accepted Answer

The pod resource requests exceed the allocatable resources on the existing nodes after accounting for system reservations.. The cluster has 3 e2-standard-4 nodes, each with 4 vCPU and 16 GB RAM. After accounting for system reservations (e.g., kubelet, OS, daemonsets), the allocatable memory per node is typically around 13-14 GB. With 10 pods each requesting 2 GB, the total memory request is 20 GB, but the total allocatable memory across 3 nodes is only about 39-42 GB. However, the autoscaler can only scale up to 5 nodes, and even then, the total allocatable memory would be around 65-70 GB, which is sufficient. The most likely cause is that the pod resource requests exceed the allocatable resources on the existing nodes, preventing scheduling, and the autoscaler may not have triggered yet or is constrained by other factors like CPU or node limits.

Answer

The cluster is running an older version of Kubernetes that does not support node auto-scaling.

Answer

The node pool autoscaler is not properly configured to scale up based on pod resource requests.

Answer

The node auto-repair feature is disabled, causing a node to be unhealthy.

Question 15

A multinational corporation has deployed a web application across multiple Google Cloud regions using an external HTTPS load balancer with backend services in each region. They recently added a new region (asia-southeast1) and updated the load balancer configuration. After the update, some users in that region report high latency and occasional connection timeouts when accessing the application. The load balancer health checks show all backends as healthy. The network team confirms that the backend instances in asia-southeast1 are correctly configured and can be accessed directly via their external IPs. What should the architects investigate next?

Accepted Answer

Review the Cloud Armor security policy rules that might be blocking traffic from that region. Cloud Armor security policies can block traffic based on geographic location. If the new region (asia-southeast1) was added but the Cloud Armor policy was not updated to allow traffic from that region, requests from users in asia-southeast1 could be denied or rate-limited, causing high latency and timeouts even though health checks (which originate from Google's health check ranges, not user IPs) show backends as healthy. The direct access via external IPs works because it bypasses the load balancer and its associated Cloud Armor policy.

Answer

Check the Cloud CDN cache settings for the new region

Answer

Verify that the backend service in asia-southeast1 has the correct timeout settings for the load balancer

Answer

Ensure that the firewall rules allow traffic from the load balancer's health check ranges to the instances

Question 16

Your company runs a stateful application on GKE that stores data in persistent volumes backed by Compute Engine persistent disks. You need to back up the application data and the Kubernetes resource configurations (deployments, services, etc.) for disaster recovery. Which tool should you use?

Accepted Answer

Velero. Velero (formerly Heptio Ark) is an open-source tool for backing up and restoring Kubernetes cluster resources and persistent volumes. It supports GCP as a storage destination (Cloud Storage). Cloud Storage versioning can back up files but not Kubernetes resources. gcloud container clusters create does not back up. Cloud SQL is for relational databases.

Answer

gcloud container clusters create --async

Answer

Cloud SQL for MySQL

Answer

Cloud Storage with object versioning and lifecycle policies

Question 17

You are designing a Dataflow streaming pipeline for real-time event processing. The pipeline must be cost-effective while tolerating worker failures without data loss. Which configuration should you use?

Accepted Answer

Use a Dataflow streaming job with Streaming Engine, autoscaling, and non-preemptible workers.. A standard Dataflow streaming job (non-FlexRS) with non-preemptible workers and Streaming Engine enabled provides failure tolerance without data loss. Non-preemptible workers are not subject to termination, reducing failure frequency, and Streaming Engine's durable state checkpointing preserves progress across any worker failures. While preemptible workers are cheaper, they introduce higher failure risk; FlexRS is batch-only and cannot be used for streaming pipelines. Therefore, option D is the correct choice for a cost-effective (via autoscaling) and reliable streaming pipeline.

Answer

Use a batch Dataflow job with preemptible workers.

Answer

Use high-memory machine types for all workers to avoid preemption.

Answer

Use FlexRS with preemptible workers and enable streaming engine.

Question 18

A developer needs to programmatically create and manage Compute Engine instances. Which Google Cloud service should they use to authenticate and authorize service accounts?

Accepted Answer

Cloud IAM. Cloud IAM is the correct service because it provides the identity and access management framework for authenticating and authorizing service accounts. When a developer creates Compute Engine instances, they must attach a service account and grant IAM roles (e.g., roles/compute.instanceAdmin) to define what actions that service account can perform. Cloud IAM handles the authentication via OAuth 2.0 tokens and authorization via role-based access control (RBAC), making it the foundational service for managing service account permissions.

Answer

Cloud Audit Logs

Answer

Cloud Key Management Service (KMS)

Answer

Cloud Scheduler

Question 19

Which THREE Google Cloud services can be used to implement a zero-trust architecture for network security? (Choose three.)

Accepted Answer

Cloud Armor. Cloud Armor is correct because it provides web application firewall (WAF) and DDoS protection at the edge of Google's network, enforcing security policies based on IP addresses, geo-locations, and Layer 7 attributes. This aligns with zero-trust principles by inspecting and filtering traffic before it reaches the application, ensuring that only authorized requests are allowed, regardless of the network perimeter.

Answer

VPC Networks

Answer

Cloud VPN

Question 20

A company wants to implement a disaster recovery (DR) strategy for their Cloud SQL for MySQL databases. They need to be able to recover to a specific point in time (within seconds) in case of accidental data deletion. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Enable binary logging (binlog). Point-in-time recovery (PITR) in Cloud SQL uses transaction logs to restore to any point in time within the backup retention period. Automated backups are required to enable PITR. Cross-region replication is for regional DR but not point-in-time.

Answer

Configure a failover replica in another zone

Answer

Create a cross-region read replica

Answer

Export the database daily to Cloud Storage