Google PCA Practice Exam 58 — 20 Questions

Question 1

A company monitors their application with Cloud Monitoring. They set up an alerting policy to notify the on-call team when the 99th percentile latency exceeds 500 ms for 5 minutes. However, they receive false positive alerts due to short bursts. How should they refine the policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the evaluation window to 10 minutes.. Increasing the evaluation window to 10 minutes smooths out short bursts of high latency, ensuring the alert triggers only when the 99th percentile latency exceeds 500 ms for a sustained period. Cloud Monitoring evaluates metrics over the specified window, so a longer window reduces false positives from transient spikes while still detecting genuine degradation.

Answer

Set up alerting on each data point individually.

Answer

Decrease the threshold to 400 ms.

Answer

Change the metric to average latency instead of 99th percentile.

Question 2

A company deploys a microservices application on Google Kubernetes Engine (GKE). Pods in one deployment are frequently OOMKilled. The team sets memory requests and limits, but pods still crash. What is the most likely remaining cause?

Accepted Answer

The application has a memory leak that eventually exceeds the limit.. OOMKilled errors occur when a container exceeds its memory limit. Setting memory requests and limits prevents unbounded usage, but if the application has a memory leak, it will continue to consume memory until it hits the configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the pod. The fact that pods still crash after setting limits indicates the application itself is the root cause, not resource configuration.

Answer

CPU requests are too low, causing throttling and eventual crash.

Answer

The node pool is too small, causing memory pressure on the node.

Answer

Memory limits are set higher than the node's allocatable memory.

Question 3

A company stores sensitive data in Cloud Storage and wants to enforce encryption at rest using customer-managed keys. Which Google Cloud service should they use to manage the keys?

Accepted Answer

Cloud KMS. Cloud KMS (Key Management Service) is the correct choice because it is the native Google Cloud service for managing cryptographic keys, including customer-managed encryption keys (CMEK). It allows you to create, rotate, and control access to keys used to encrypt data at rest in Cloud Storage, and it integrates directly with Cloud Storage's CMEK feature. Cloud HSM is a hardware-backed key management option but is built on top of Cloud KMS, not a separate service for key management.

Answer

Cloud HSM

Answer

Secret Manager

Answer

IAM

Question 4

A company has a multi-project Google Cloud environment with strict compliance requirements. They need to ensure that all projects enforce a uniform set of constraints, such as requiring CMEK for Compute Engine disk encryption and blocking the use of public IPs on VMs. They have defined these constraints using Organization Policies at the organization level. However, the security team discovers that some projects are not enforcing the constraints because they have been overridden at the project level by the respective project owners. The security team wants a solution that prevents project-level overrides while maintaining the ability to apply exceptions at a folder level when approved. What should they do?

Accepted Answer

Move all projects under a common folder and set the Organization Policies at that folder level with 'enforce: true'.. Setting the Organization Policy at the folder level with 'enforce: true' ensures project-level overrides are blocked, while still allowing folder-level exceptions. Option A is wrong because Forseti Security can automate remediation but does not prevent overrides natively; it's not a replacement for organizational policy enforcement. Option B is wrong because Cloud Asset Inventory only monitors and alerts; it does not enforce policies. Option C is wrong because manually removing overrides is not scalable and does not prevent future overrides.

Answer

Deploy Forseti Security to automatically remediate when projects override policies.

Answer

Use Cloud Asset Inventory to monitor for non-compliant projects and alert the security team.

Answer

Manually remove the overridden policies in each project and set the constraints at the organization level again.

Question 5

Which TWO actions should you take to improve the reliability of a stateful application deployed on Compute Engine with regional persistent disks?

Accepted Answer

Use a regional persistent disk to replicate data across two zones.. Regional persistent disks (RPDs) synchronously replicate data between two zones within a region, ensuring that if one zone fails, the data remains available in the other zone without data loss. This directly improves the reliability of a stateful application by providing a durable, zone-failure-tolerant storage layer that maintains data consistency across zones.

Answer

Use preemptible VMs to reduce costs.

Answer

Place an HTTP(S) load balancer in front of the application.

Answer

Schedule regular snapshots of the persistent disk to Cloud Storage.

Question 6

A company is deploying a critical application on Compute Engine with an HTTP load balancer. They want to ensure that if an instance health check fails, traffic is automatically rerouted to healthy instances. Which configuration should they implement?

Accepted Answer

Use an HTTP(S) load balancer with a backend service configured with a health check and enable connection draining.. An HTTP(S) load balancer with a backend service configured with a health check automatically monitors instance health and reroutes traffic away from unhealthy instances. Enabling connection draining ensures that in-flight requests to an unhealthy instance are given time to complete before the instance is removed from the load balancing pool, preventing disruption to active sessions.

Answer

Use an internal load balancer with a backend service configured with a health check.

Answer

Use a network load balancer with a health check configured on the target pool.

Answer

Use an HTTP(S) load balancer with a backend service configured with a health check and enable session affinity.

Answer

Use a TCP proxy load balancer with a backend service configured with a health check.

Question 7

A company is planning a hybrid cloud architecture using Anthos to manage workloads across on-premises data centers and Google Cloud. They need to select two key components that enable consistent configuration, policy, and security across environments. Which two should they choose?

Accepted Answer

GKE on-prem. GKE on-prem (now Anthos clusters on bare metal or VMware) is correct because it provides a consistent Kubernetes platform that runs on-premises, enabling the same container orchestration, policy enforcement, and security controls as GKE in Google Cloud. Config Sync is correct because it continuously reconciles the desired state of cluster configurations from a Git repository, ensuring that policies, RBAC, and security settings remain identical across all Anthos clusters, whether on-prem or in the cloud.

Answer

Cloud Interconnect

Answer

Cloud Build

Answer

Cloud Load Balancing

Question 8

Refer to the exhibit. What is the primary benefit of the `--preemptible` flag in this command?

Accepted Answer

Significant cost reduction compared to standard instances.. The `--preemptible` flag in Google Cloud Platform (GCP) creates preemptible VM instances, which are short-lived, cost-effective instances that can be terminated at any time by GCP. The primary benefit is a significant cost reduction—up to 60-91% lower than standard instances—making them ideal for batch jobs, fault-tolerant workloads, and non-critical tasks. This flag does not affect startup time, availability guarantees, or provide free access to specialized hardware.

Answer

Faster instance startup time due to optimized kernel.

Answer

Higher availability through automatic restart on failure.

Answer

Access to specialized hardware like GPUs at no extra cost.

Question 9

Your company wants to implement a canary deployment for a microservice running on GKE. You need to gradually shift traffic from the stable version to the canary version while monitoring error rates. Which THREE components or practices should you use? (Choose 3)

Accepted Answer

Cloud Deploy with an automated canary strategy and verification. A canary deployment on GKE typically uses a service mesh like Istio for fine-grained traffic splitting, Cloud Monitoring for observability, and automated rollback via a progressive delivery tool or manual intervention. Cloud Deploy also supports canary strategies. Cloud CDN is for content delivery, not internal traffic splitting. Feature flags are for feature toggles, not traffic shifting.

Answer

Cloud CDN for caching responses

Answer

Feature flags in the application code

Question 10

An organization is implementing a data loss prevention (DLP) strategy for Cloud Storage. They want to automatically scan new objects uploaded to a specific bucket and redact sensitive data. Which service and configuration should they use?

Accepted Answer

Use Cloud Functions triggered by Cloud Storage events to call Cloud DLP API for each new object, and then store the redacted version.. It uses Cloud Functions as an event-driven compute service that triggers on Cloud Storage object finalize events. The function then calls the Cloud DLP API to inspect and redact sensitive data from the new object, and writes the redacted version back to the bucket. This provides automatic, near-real-time scanning and redaction for each uploaded object, aligning with the requirement for an automated DLP strategy.

Answer

Configure Cloud Armor with a WAF rule to inspect and redact data as it enters the bucket.

Answer

Enable Security Command Center (SCC) premium tier and configure it to scan the bucket for sensitive data.

Answer

Use Cloud DLP with a BigQuery external table to scan the bucket contents periodically.

Question 11

A company uses Cloud Interconnect to connect on-premises network to GCP. They want to ensure that if one interconnect link fails, traffic is automatically rerouted to another link. Which configuration should they implement?

Accepted Answer

Create a second interconnect in a different metro and use BGP with MED.. Using a second interconnect in a different metro with BGP MED (Multi-Exit Discriminator) allows you to influence inbound traffic path selection and provides true geographic redundancy. If one interconnect link fails, BGP withdraws the routes, and traffic automatically fails over to the remaining interconnect via the alternate path, ensuring high availability without relying on a single point of failure.

Answer

Configure BGP sessions with equal-cost multi-path (ECMP) over multiple interconnect links.

Answer

Use a VPN as backup for the interconnect.

Answer

Use a single VLAN attachment with multiple interconnect links.

Answer

Use multiple VLAN attachments with the same interconnect.

Question 12

A company is migrating a monolithic application to Google Cloud. They want to minimize changes to the application code while taking advantage of Cloud Run for serverless containers. Which approach should they take?

Accepted Answer

Use Cloud Run by packaging the existing application as a container and listening on a web server.. Cloud Run can run any containerized application that listens on HTTP requests on port 8080. By packaging the existing monolithic application as a container and adding a lightweight web server (e.g., Express, Flask, or Nginx), the company can deploy it to Cloud Run with minimal code changes, leveraging serverless scaling and pay-per-use pricing without refactoring into microservices.

Answer

Deploy the application to App Engine standard environment with automatic scaling.

Answer

Lift and shift the application to Compute Engine instances behind a load balancer.

Answer

Refactor the application into microservices and deploy each as a separate Cloud Run service.

Question 13

A startup wants to deploy a web application on Google Cloud with a MySQL database. They anticipate low traffic initially but want the ability to scale seamlessly. They also want to minimize operational overhead. Which combination of services should they choose?

Accepted Answer

App Engine Standard Environment with Cloud SQL.. App Engine Standard Environment provides a fully managed, autoscaling platform for web applications, while Cloud SQL offers a managed MySQL database with automatic replication and backups. This combination minimizes operational overhead because Google handles infrastructure provisioning, patching, and scaling, and Cloud SQL integrates natively with App Engine via the Cloud SQL proxy or Unix socket, requiring no manual configuration for connectivity.

Answer

Compute Engine with a self-managed MySQL instance.

Answer

Cloud Run with Cloud Spanner.

Answer

Google Kubernetes Engine (GKE) with Cloud SQL.

Question 14

A company is migrating an on-premises PostgreSQL database (5 TB) to Cloud SQL. They need minimal downtime and automated schema conversion if needed. Which GCP service should they use?

Accepted Answer

Database Migration Service (DMS). Database Migration Service (DMS) supports continuous migration with minimal downtime from on-premises PostgreSQL to Cloud SQL. It handles schema and data migration. Migrate for Compute Engine is for VM migration, Transfer Appliance is for bulk data transfer, and Datastream is for streaming replication to BigQuery.

Answer

Datastream

Answer

Migrate for Compute Engine (formerly Velostrata)

Answer

Transfer Appliance

Question 15

A company wants to store customer transaction logs for 7 years for compliance. The logs are accessed rarely but must be retrievable within 24 hours. Which storage option is most cost-effective?

Accepted Answer

Cloud Storage Archive class. Cloud Storage Archive class is the most cost-effective option for data that is accessed rarely and requires retrieval within 24 hours. Archive class offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of 12 hours, which comfortably meets the 24-hour requirement. This makes it ideal for long-term compliance retention of transaction logs that are infrequently accessed.

Answer

Cloud Storage Nearline class

Answer

Cloud Storage Coldline class

Answer

Cloud Storage Standard class

Question 16

A company is migrating a critical on-premises application to Google Cloud. The application consists of a frontend web server that handles user requests and a backend database server that stores session state and processed data. The application is stateful because session data is stored in memory on the backend server. The company wants to minimize downtime during migration and ensure that the application can scale horizontally in the future. The current on-premises architecture has the web server and database server on separate physical machines. The web server communicates with the database server via a private network. The company expects that after migration, the application will need to handle double the current traffic. They also need to ensure that the architecture is resilient to zone failures within a single region. They are considering using Compute Engine for both the web and database servers, but they are open to other Google Cloud services. They have a requirement that the database must be relational and support ACID transactions. The database currently uses Microsoft SQL Server, but they are willing to migrate to a different database engine if it reduces operational overhead and provides better scalability. The team has limited experience with Google Cloud and wants to minimize architectural changes. Which course of action should the company take?

Accepted Answer

Migrate the web server to Compute Engine with a managed instance group and internal load balancer. Migrate the database to Cloud SQL for SQL Server with high availability across zones.. It preserves the existing stateful architecture by using Compute Engine with a managed instance group and internal load balancer for the web tier, and Cloud SQL for SQL Server with cross-zone high availability for the database. This minimizes architectural changes, supports horizontal scaling via the managed instance group, and provides zone-level resilience for the relational database with ACID transactions, meeting the requirement to handle double traffic while minimizing downtime.

Answer

Refactor the application to be stateless. Migrate the web server to App Engine and the database to Cloud SQL for PostgreSQL. Use Cloud Memorystore for session state.

Answer

Migrate the web server to Compute Engine and the database to Cloud Spanner. Use a global load balancer for the web server and Spanner for transactional consistency.

Answer

Lift and shift both web and database servers to Compute Engine. Use a managed instance group with autoscaling for the web server and a standalone VM for the database. Configure persistent disks for data.

Question 17

You are using Cloud SQL for PostgreSQL. You want to ensure that data can be recovered to any point within the last 7 days. What should you enable?

Accepted Answer

Enable automated backups and set the backup configuration to enable binary logging (point-in-time recovery).. Enabling automated backups with binary logging (also known as write-ahead logging or WAL archiving) in Cloud SQL for PostgreSQL allows point-in-time recovery (PITR). This lets you restore your database to any specific timestamp within the retention window, which you can set to 7 days. Automated backups alone only provide daily snapshot restores, not the granularity needed for recovery to any point in time.

Answer

Export the database daily to Cloud Storage.

Answer

Create a cross-region read replica.

Answer

Enable automated backups with a 7-day retention period.

Question 18

A company wants to run batch processing workloads that can be interrupted and resumed, at the lowest possible cost. The jobs are fault-tolerant and can handle preemption. They also need predictable pricing for a baseline amount of compute. Which combination of compute options should they use?

Accepted Answer

Use committed use discounts for baseline capacity and preemptible VMs for additional burst capacity. Preemptible VMs (or Spot VMs) are significantly cheaper but can be terminated at any time. Committed use discounts provide a discount for a 1- or 3-year commitment. Using committed use discounts for a baseline ensures predictable pricing, and using preemptible VMs for additional capacity reduces cost further. Sustained use discounts apply automatically but are not as cost-effective as committed discounts for predictable baseline. Standard VMs are more expensive.

Answer

Use spot VMs for all workloads and rely on automatic restart

Answer

Use standard VMs with sustained use discounts

Answer

Use only preemptible VMs for all workloads

Question 19

A company is using Cloud Storage to store sensitive data. They need to enforce that objects are deleted exactly 30 days after creation. Which object lifecycle rule should they configure?

Accepted Answer

Delete action with condition age: 30.. The 'Delete action with condition age: 30' directly instructs Cloud Storage to remove objects 30 days after their creation time. The 'age' condition is measured from the object's creation timestamp, which aligns perfectly with the requirement to delete objects exactly 30 days after creation.

Answer

AbortIncompleteMultipartUpload after 30 days.

Answer

Delete action with condition daysFromNonCurrentTime: 30.

Answer

SetStorageClass to Nearline after 30 days.

Question 20

A company runs a streaming data pipeline using Dataflow to process real-time data and insert into BigQuery. Recently, workers are frequently failing with out-of-memory errors and the pipeline latency is increasing. What should they do to resolve the issue?

Accepted Answer

Enable Dataflow Streaming Engine. Dataflow Streaming Engine offloads the streaming data processing state and shuffle data from worker memory to a backend service, reducing memory pressure on workers. This directly addresses out-of-memory errors and latency increases without requiring manual scaling or machine type changes. It is the recommended solution for streaming pipelines experiencing memory bottlenecks.

Answer

Increase the worker machine type and memory

Answer

Use Cloud Pub/Sub for buffering and then load into BigQuery in batches

Answer

Enable autoscaling and increase the maximum number of workers