Google PCA Practice Exam 57 — 20 Questions

Question 1

A company is planning to deploy a global web application on Google Cloud. They expect low latency for users worldwide and need to serve static content (images, CSS) as well as dynamic API responses. Which architecture should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud CDN in front of an external HTTPS Load Balancer with backend services in multiple regions.. Cloud CDN in front of an external HTTPS Load Balancer with backend services in multiple regions is correct because it provides global anycast IP termination, low-latency content delivery via Google's edge cache for static content, and dynamic API requests are forwarded to the nearest healthy backend in the closest region. This architecture meets both the low-latency requirement for users worldwide and the need to serve both static and dynamic content efficiently.

Answer

Use Cloud NAT to allow egress traffic from instances and distribute static content via a shared VPC.

Answer

Use Cloud DNS with geo-routing to direct users to the closest regional Cloud Run service.

Answer

Use VPC Network Peering to connect multiple regional VPCs and serve content from a central location.

Question 2

A company is migrating 50 TB of on-premises file server data to Cloud Storage. The network bandwidth is limited to 100 Mbps. What is the most cost-effective and time-efficient migration method?

Accepted Answer

Use Transfer Appliance. Transfer Appliance is Google's physical device for transferring large amounts of data when network is slow or expensive. It avoids lengthy uploads over limited bandwidth. Storage Transfer Service is for cloud-to-cloud, not on-prem. gsutil cp and rsync over 100 Mbps would take weeks.

Answer

Use gsutil cp to copy files directly

Answer

Use gsutil rsync to synchronize

Answer

Use Storage Transfer Service

Question 3

Which Google Cloud service allows you to create alerting policies based on log entries?

Accepted Answer

Cloud Monitoring. Cloud Monitoring is the service that manages alerting policies, including those triggered by log-based metrics. While Cloud Logging provides the interface to create log-based metrics from log entries, the alerting policy itself is created and managed in Cloud Monitoring. Therefore, the correct service for creating alerting policies based on log entries is Cloud Monitoring.

Answer

Cloud Logging

Answer

Cloud Audit Logs

Answer

Error Reporting

Question 4

A company is using Cloud Storage for backups and wants to minimize costs. The backups are accessed infrequently and can tolerate retrieval delays. Which storage class is most appropriate?

Accepted Answer

Archive. Archive storage class is the most cost-effective option for backups that are accessed infrequently and can tolerate retrieval delays. It offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of minutes to hours, making it ideal for long-term backup data that does not require immediate access.

Answer

Standard

Answer

Coldline

Answer

Nearline

Question 5

Your organization has a policy that all Compute Engine instances must have specific labels (env, team, cost-center) applied. You want to enforce this automatically when instances are created. What should you do?

Accepted Answer

Use the Organization Policy service with a custom constraint to require labels on Compute Engine instances.. Organization Policy Service with a custom constraint allows you to enforce that all Compute Engine instances must have specific labels (env, team, cost-center) at creation time. This is a preventive control that blocks creation of non-compliant instances, unlike reactive or permission-based approaches. Custom constraints use the `compute.googleapis.com/instance` resource type and can require label keys or values using CEL (Common Expression Language) syntax.

Answer

Enable Cloud Audit Logs and set up a metric-based alert to detect instances without labels.

Answer

Create a Cloud Function that listens for instance creation events and adds labels automatically.

Answer

Assign a custom IAM role that includes permission to label instances, and remove the default compute.instances.create permission.

Question 6

A company is designing a disaster recovery plan for a critical application running on Compute Engine. The application uses a PostgreSQL database and stores files on persistent disks. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. Which two actions should the company take?

Accepted Answer

Configure PostgreSQL replication to a standby instance in another region.. PostgreSQL replication to a standby instance in another region meets both the RPO of 1 hour (near-real-time replication keeps data loss minimal) and the RTO of 4 hours (a standby can be promoted quickly). This is a standard disaster recovery pattern for cross-region resilience, ensuring that database changes are continuously replicated with minimal lag.

Answer

Create an instance template for the application and store it in Cloud Storage.

Answer

Take hourly persistent disk snapshots and store them in the same region.

Answer

Use Cloud Storage to store database backups and transfer them to a different region daily.

Question 7

A company wants to back up their GKE cluster's etcd data and persistent volumes for disaster recovery. They are evaluating Velero. Which two components does Velero require to perform backups? (Choose two.)

Accepted Answer

A Cloud Storage bucket for backup storage. Velero requires two core components: a storage destination (like a Cloud Storage bucket) to store backup artifacts, and a service account with appropriate IAM permissions to authenticate with the Google Cloud APIs and access cluster resources. A kubeconfig file is used for client-side kubectl operations, not as a component for Velero backups. Velero uses its own service account to communicate with the Kubernetes API server and trigger volume snapshots. Therefore, only option D is correct; option E is incorrect because Velero does not require a kubeconfig file.

Answer

A separate database such as Cloud SQL

Answer

A Velero plugin for each persistent volume

Answer

A dedicated backup server with stateful storage

Answer

Access to the cluster's kubeconfig file

Question 8

Which THREE components are required to set up a private connection between an on-premises network and a VPC using Cloud VPN? (Choose three.)

Accepted Answer

Peer VPN gateway (on-premises).. A Peer VPN gateway represents the on-premises VPN device that terminates the IPsec tunnel from the Cloud VPN gateway. This is a required component to establish the encrypted tunnel between your on-premises network and the VPC, as it defines the public IP address and configuration of the remote endpoint.

Answer

VPC Network Peering.

Answer

Cloud Router.

Question 9

Refer to the exhibit. This is an IAM policy for a BigQuery dataset. What does the policy allow?

Accepted Answer

Alice to view data and analysts to run jobs.. The policy grants the `roles/bigquery.dataViewer` role to Alice, which allows her to view dataset metadata and query data, and the `roles/bigquery.jobUser` role to analysts, which allows them to run jobs (queries, load, export) but not view data directly. This combination matches option A.

Answer

Alice and analysts to run jobs.

Answer

Alice to run jobs and analysts to view data.

Answer

Alice and analysts to view data.

Question 10

A service account needs to be able to start and stop Compute Engine instances in a specific project. Which IAM role should be assigned at the project level?

Accepted Answer

roles/compute.instanceAdmin.v1. Roles/compute.instanceAdmin.v1, because this role grants the necessary permissions to start, stop, and manage Compute Engine instances, including operations like instances.start and instances.stop, at the project level. This role is specifically designed for managing compute resources without granting broader project-level access like editing all resources.

Answer

roles/iam.serviceAccountUser

Answer

roles/editor

Answer

roles/compute.viewer

Question 11

A developer wants to automate the creation of a Google Cloud project with a specific VPC and firewall rules. Which tool should they use?

Accepted Answer

Deployment Manager. Deployment Manager is the correct tool because it allows you to define and manage Google Cloud resources, including projects, VPCs, and firewall rules, using declarative templates (YAML, Python, or Jinja2). This enables infrastructure-as-code (IaC) automation, which is essential for repeatable and version-controlled project creation. Unlike interactive tools, Deployment Manager handles the entire lifecycle of resources, including dependencies and updates, without manual intervention.

Answer

Cloud Shell

Answer

Cloud Console

Answer

Cloud SDK

Question 12

A large e-commerce company runs a multi-tier application on Google Cloud. The frontend is served by a global HTTP Load Balancer with a backend service pointing to a managed instance group (MIG) of nginx web servers. The application tier consists of a regional internal TCP/UDP load balancer distributing traffic to a MIG of Java application servers. The database tier uses Cloud SQL for PostgreSQL in a failover replica configuration. The architecture is deployed in the us-central1 region across three zones. Recently, the operations team noticed intermittent 502 Bad Gateway errors from the frontend load balancer during peak traffic hours. The errors last for a few minutes and then recover. The team suspects the application tier is overwhelmed. They need to implement a solution that can handle traffic spikes without manual intervention. Which course of action should they take?

Accepted Answer

Configure HTTP health checks on the regional internal load balancer and set the autoscaler to use the 'HTTP load balancing utilization' metric for the application tier MIG.. The intermittent 502 errors during peak traffic indicate that the application tier MIG is being overwhelmed. By configuring HTTP health checks on the regional internal load balancer and setting the autoscaler to use the 'HTTP load balancing utilization' metric, the autoscaler can scale the application tier MIG based on the actual load distribution from the internal load balancer, ensuring it handles traffic spikes without manual intervention. This directly addresses the root cause—insufficient application instances—by enabling dynamic scaling based on real-time utilization.

Answer

Increase the maximum number of instances in the application tier MIG from 10 to 20.

Answer

Enable Cloud Armor on the frontend load balancer with a rate-limiting rule to block excessive traffic.

Answer

Enable Cloud CDN on the frontend load balancer to cache static assets and reduce load on the application tier.

Question 13

Refer to the exhibit. An application running on a GCE instance (ID: 1234567890) is unable to connect to a database at 10.0.0.1:5432. The logs show repeated 'Connection refused' errors. What is the most likely cause?

Accepted Answer

The database service is not running or is not listening on port 5432.. The 'Connection refused' error indicates that the TCP handshake was rejected by the target host, which typically means the database service is not actively listening on port 5432. This is distinct from a firewall block, which would result in a timeout or 'no route to host' error. Since the error is immediate and specific to port 5432, the most likely cause is that the PostgreSQL or other database service is not running or is bound to a different interface/port.

Answer

The firewall rule allowing traffic on port 5432 is missing or misconfigured.

Answer

The instance is using an outdated SSL certificate.

Answer

The VPC network has no route to the database subnet.

Question 14

A company is migrating to Google Cloud and needs to connect their on-premises network to a VPC. They require high bandwidth and a reliable connection with a Service Level Agreement (SLA). Which solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google's network, offering high bandwidth (10 or 100 Gbps per link) and a 99.99% uptime SLA when configured with redundant links. This meets the requirements for high bandwidth and a reliable, SLA-backed connection better than any other option.

Answer

Cloud VPN with dynamic routing

Answer

Partner Interconnect via a service provider

Answer

Direct Peering

Question 15

The exhibit shows a Cloud Storage bucket configuration. What does this configuration ensure?

Accepted Answer

Objects can only be permanently deleted after the retention period expires.. The exhibit shows a bucket configured with a retention policy. When a retention policy is set on a Cloud Storage bucket, objects cannot be deleted or overwritten until the retention period expires. This ensures that objects can only be permanently deleted after the retention period ends, which is exactly what option C describes.

Answer

Older versions of objects are automatically transferred to a different storage class.

Answer

Data is replicated to another region for disaster recovery.

Answer

Objects older than 30 days will be automatically deleted.

Question 16

Refer to the exhibit. A Cloud Deploy pipeline has a release with two targets: staging and prod. The staging rollout succeeded, but the prod rollout failed with 'MANIFEST_INVALID'. What is the most likely cause of the failure?

Accepted Answer

The manifest for prod contains a syntax error or references a resource that does not exist in the prod cluster.. The 'MANIFEST_INVALID' error in Cloud Deploy indicates that the Kubernetes manifest provided for the prod target is syntactically incorrect or references a resource (e.g., a ConfigMap, Secret, or custom resource definition) that does not exist in the prod cluster. This is a validation failure that occurs before any deployment attempt, so it is not related to runtime issues like permissions or quotas.

Answer

The prod target's applyManifest has a higher replica count than staging, which violates a cluster quota.

Answer

The prod cluster does not have the necessary permissions to pull the container image.

Answer

The release was not approved for the prod target.

Question 17

An organization has multiple projects in Google Cloud and wants to centralize logging and monitoring for all projects. They need to aggregate logs from all projects into a single project for analysis. Which approach should they use?

Accepted Answer

Create a logs sink in each project that exports logs to a BigQuery dataset in the central project.. Google Cloud's logs sink feature allows you to route logs from multiple source projects to a centralized BigQuery dataset in a single destination project. This approach aggregates logs efficiently without requiring agents or manual import steps, and it supports real-time log export for analysis.

Answer

Export logs from each project to a Cloud Storage bucket and then import them into BigQuery.

Answer

Enable Cloud Audit Logs for all projects and view them from the central project.

Answer

Install the Stackdriver agent on all VMs and point them to the central project.

Question 18

A developer needs to pass a startup script to a Compute Engine instance during creation. Which method should be used to ensure the script runs on first boot?

Accepted Answer

Use gcloud compute instances create with --metadata=startup-script=.... The `--metadata=startup-script=...` flag on `gcloud compute instances create` passes the script as instance metadata. Compute Engine automatically executes the value of the `startup-script` metadata key on every boot, including the first boot. This is the standard, documented method for providing a startup script at instance creation time.

Answer

Create a custom image with the script baked in.

Answer

Use gcloud compute instances add-metadata after creating the instance.

Answer

Use gcloud compute instances create with --startup-script flag.

Question 19

A company wants to protect their web application hosted on Google Cloud HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting (XSS). Which GCP service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF (Web Application Firewall) capabilities including preconfigured rules to block OWASP Top 10 attacks like SQL injection and XSS. IAP is for access control, not attack prevention. VPC Service Controls are for data exfiltration prevention. Cloud CDN is for caching content.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Answer

VPC Service Controls

Question 20

A healthcare organization uses Cloud Storage to store protected health information (PHI). They have a compliance requirement to ensure that all objects in the bucket are encrypted with a customer-managed key (CMK) that is rotated every 90 days. They also need to log all access to the bucket and detect anomalous access patterns. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle. Cloud Storage with CMEK via Cloud KMS allows the organization to use a customer-managed key that can be rotated every 90 days, meeting the compliance requirement. Cloud Audit Logs capture all access to the bucket, and Chronicle provides advanced security analytics to detect anomalous access patterns, fulfilling the logging and detection needs.

Answer

Cloud Storage with default encryption, Cloud Audit Logs, and Security Command Center

Answer

Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud DLP

Answer

Cloud Storage with CSEK, Cloud Audit Logs, and Security Command Center