Google PCA Practice Exam 59 — 20 Questions

Question 1

You are designing a disaster recovery plan for a Cloud SQL for MySQL instance. The instance is in us-east1. You need to be able to recover the database to a specific second in time within the past 7 days in the event of a regional outage. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable point-in-time recovery and create a cross-region read replica. If needed, promote and recover the replica to the desired point in time.. Cloud SQL point-in-time recovery (PITR) allows recovery to any second within the backup retention period. For regional disaster recovery, you need cross-region replicas. Enabling PITR on the primary and creating a cross-region replica (which also supports PITR) allows you to recover the replica to a specific point in time. Automated backups alone cannot restore to a specific second.

Answer

Enable automated backups and transaction log retention for 7 days. Restore the backup in a new instance in a different region.

Answer

Use Cloud SQL's built-in replication to create a cross-region replica, and enable failover. Failover automatically recovers to the latest transaction.

Answer

Export the database daily using gcloud sql export and store in Cloud Storage with versioning.

Question 2

Refer to the exhibit. A Cloud Run service is experiencing high latency and returns 502 errors when traffic spikes. What should the team adjust first?

Accepted Answer

Decrease containerConcurrency to 10. The 502 errors and high latency during traffic spikes indicate that the Cloud Run service is overwhelmed by concurrent requests. Decreasing `containerConcurrency` to 10 limits the number of simultaneous requests each container instance can handle, which reduces the likelihood of request timeouts and 502 errors by forcing Cloud Run to scale out more instances sooner. This directly addresses the root cause—excessive concurrency per container—without incurring additional cost or requiring code changes.

Answer

Increase the maximum number of instances

Answer

Increase the CPU limit to 2000m

Answer

Increase the memory limit to 512Mi

Question 3

A startup runs a web application on Google Kubernetes Engine (GKE) with 3 replicas serving user traffic. They use Cloud SQL for the database. Recently, the application experienced intermittent timeouts during peak hours. Monitoring shows high CPU usage on the GKE nodes and increased database connection pool exhaustion. The team is looking for a cost-effective solution that minimizes architectural changes. The application is stateless. What should they do?

Accepted Answer

Increase the number of pod replicas and configure a connection pooler like PgBouncer for Cloud SQL. The application is stateless and experiencing database connection pool exhaustion alongside high CPU on GKE nodes. Increasing pod replicas distributes the CPU load across more pods, while adding a connection pooler like PgBouncer reduces the number of direct connections to Cloud SQL, preventing pool exhaustion without requiring database tier changes. This approach is cost-effective because it optimizes existing resources rather than scaling infrastructure.

Answer

Add more nodes to the GKE cluster and enable cluster autoscaling

Answer

Vertically scale the GKE node pool to larger machine types and increase Cloud SQL tier

Answer

Set up a Cloud SQL read replica and route read queries to it

Question 4

A company manages secrets for multiple microservices using Secret Manager. They need to ensure that each service can access only its own secrets, and that all access is logged. What is the best IAM architecture?

Accepted Answer

Create custom roles with secrets.get permission and bind to each service account at the individual secret resource.. It follows the principle of least privilege by binding custom roles with the `secrets.get` permission at the individual secret resource level, ensuring each microservice can only access its own secrets. This also enables fine-grained access control and logging, as Secret Manager audit logs capture each access attempt per secret and service account. By using a custom role, you avoid granting unnecessary permissions like `list` or `create`, which are included in predefined roles.

Answer

Grant each service account the roles/secretmanager.secretAccessor role at the project level.

Answer

Use a single service account for all microservices with access to all secrets.

Answer

Grant each service account the roles/secretmanager.admin role at the secret level.

Question 5

What are two best practices for designing a scalable Kubernetes architecture on GKE?

Accepted Answer

Enable horizontal pod autoscaling. Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU/memory utilization or custom metrics, which is essential for handling variable workloads in a scalable Kubernetes architecture on GKE. HPA works by querying the Metrics Server and adjusting the `replicas` field in the Deployment or StatefulSet, ensuring efficient resource usage without manual intervention.

Answer

Use StatefulSets for stateless applications

Answer

Disable Cluster Autoscaler

Answer

Use a single zone cluster

Question 6

After a data corruption incident, a company needs to restore their Cloud SQL for PostgreSQL instance from a backup. What is the correct procedure to minimize downtime?

Accepted Answer

Restore the backup directly to the existing Cloud SQL instance. Restoring a backup directly to the existing Cloud SQL instance is the fastest method to minimize downtime because it overwrites the current data in-place without requiring DNS propagation, connection string changes, or reconfiguration of applications. Cloud SQL supports in-place restore from automated or on-demand backups, which typically completes within minutes for most instance sizes, as the operation leverages the underlying storage layer to apply the backup snapshot directly to the existing persistent disk.

Answer

Create a new instance from the backup, then rename and delete the old instance

Answer

Use point-in-time recovery to restore to a time before corruption

Answer

Export the backup to Cloud Storage and import into the existing instance

Question 7

A startup is building a mobile app backend that requires real-time data synchronization across multiple users. They need a fully managed, serverless NoSQL database that scales automatically and supports offline persistence. Which database should they choose?

Accepted Answer

Cloud Firestore. Firestore is a serverless NoSQL document database designed for mobile apps with real-time sync, offline support, and automatic scaling. Cloud Bigtable is for high-throughput time-series data, not mobile. Cloud SQL is relational and not serverless. Cloud Spanner is globally distributed relational, overkill for a mobile app backend.

Answer

Cloud Spanner

Answer

Cloud Bigtable

Answer

Cloud SQL

Question 8

A company is using BigQuery for analytics and wants to optimize query costs. They have many ad-hoc queries that scan large tables. What is the best practice?

Accepted Answer

Use clustering and partitioning on tables.. Clustering and partitioning reduce the amount of data scanned by BigQuery for each query, directly lowering query costs (which are based on bytes processed). Partitioning allows queries to skip entire partitions based on a date or timestamp column, while clustering sorts data within partitions, enabling block-level pruning for filter predicates. This is the most effective and scalable way to optimize ad-hoc queries on large tables without changing the query logic.

Answer

Use flat-rate pricing.

Answer

Use BI Engine.

Answer

Use materialized views.

Question 9

A company wants to use their existing Active Directory for authentication to Google Cloud. They need to sync user and group identities to Cloud Identity and allow users to log in with their corporate credentials. Which two services should they use together?

Accepted Answer

Cloud Directory Sync and SAML SSO. Cloud Directory Sync (CDS) syncs users and groups from LDAP/AD to Cloud Identity. SAML SSO allows users to authenticate using their corporate credentials. IAP is for application access, not directory sync. Cloud Identity as a standalone does not sync automatically. Workload Identity is for Kubernetes.

Answer

Cloud Directory Sync and Workload Identity

Answer

SAML SSO and IAP

Answer

Cloud Identity and IAP

Question 10

A company runs a critical application on Compute Engine and needs a disaster recovery strategy with a Recovery Time Objective (RTO) of less than 5 minutes and a Recovery Point Objective (RPO) of less than 1 minute. The application state is stored on persistent disks. Which solution meets these requirements?

Accepted Answer

Managed instance group with regional persistent disks across multiple zones. Managed instance groups with multi-zone deployment and regional persistent disks provide synchronous replication across zones, achieving low RPO (seconds) and automatic failover for RTO under 5 minutes. Snapshots have higher RPO. VM images are for static boot disks. Coldline storage is for archiving.

Answer

Scheduled snapshots to multi-regional Cloud Storage bucket

Answer

VM images stored in a different region using Cloud Storage

Answer

Cloud Storage Coldline with lifecycle policies

Question 11

A company stores backup data in Cloud Storage. They observe high egress costs when clients download backups. Additionally, they must retain backups for 7 years for compliance. Which optimization should they implement first?

Accepted Answer

Enable requester pays on the bucket. High egress costs occur when clients download backups, and enabling requester pays shifts these costs to the clients. This directly addresses the cost issue without changing storage class or retention. Requester pays is the first optimization because it resolves the immediate cost problem while lifecycle rules or storage class changes address separate concerns like retention or storage cost.

Answer

Use lifecycle rules to transition to Archive after 30 days and delete after 7 years

Answer

Set up a Cloud CDN for backup downloads

Answer

Move the backup data to Archive storage class

Question 12

A company is using Cloud Load Balancing with backend services across multiple regions. They notice that traffic is not being evenly distributed and some backends are overloaded. Which configuration should they check?

Accepted Answer

Session affinity settings. Session affinity (sticky sessions) directs all requests from a single client to the same backend instance. If enabled, this can cause uneven load distribution because certain clients may generate disproportionately more traffic, overloading their pinned backends while others remain underutilized. Disabling or properly configuring session affinity allows the load balancer to distribute requests based on its default algorithm (e.g., round-robin or least-connections), improving balance across backends.

Answer

Firewall rules

Answer

Cloud CDN caching

Answer

Health check frequency

Question 13

A company uses Cloud CDN to accelerate content delivery. They notice that some users receive stale content even after purging the cache. Which THREE factors could cause this?

Accepted Answer

The purge request did not complete successfully.. A purge request that does not complete successfully will leave cached content intact, causing users to receive stale data. Cloud CDN processes purge requests asynchronously, and if the request fails (e.g., due to network issues or invalid paths), the cache is not invalidated. This directly explains why stale content persists despite an attempted purge.

Answer

The content is compressed with gzip.

Answer

The CDN is configured with signed URLs.

Question 14

A company is using Cloud CDN to accelerate content delivery. They notice increased costs from cache misses. What can they do?

Accepted Answer

Pre-cache popular content.. Pre-caching popular content ensures that the most frequently requested objects are already stored in Cloud CDN edge caches before users request them. This directly reduces cache misses because the content is proactively loaded, eliminating the need for the first user to trigger a fetch from the origin. By targeting high-demand assets, you minimize origin requests and lower the cost associated with cache misses.

Answer

Use a larger cache size.

Answer

Increase cache TTL.

Answer

Use compression.

Question 15

A Cloud Run service frequently fails with 502 errors when making requests to a backend service running on Compute Engine. The two services are in the same VPC network. The Cloud Run service is configured with a VPC connector. What is the most likely cause?

Accepted Answer

The VPC connector is not attached to the correct subnet, or the firewall rules are blocking traffic from the connector's IP range.. Cloud Run uses a VPC connector to send requests to resources in a VPC. If the connector is attached to the wrong subnet, its egress traffic may not reach the Compute Engine instance, or firewall rules may block traffic from the connector's IP range (e.g., 10.8.0.0/28). This results in 502 errors from the backend, as the Cloud Run service cannot establish a TCP connection to the Compute Engine instance.

Answer

The Cloud Run service needs to be peered with the VPC using VPC Network Peering.

Answer

The VPC connector is set to a low number of instances, causing traffic throttling.

Answer

The Cloud Run service's service account lacks the roles/compute.instanceAdmin role.

Question 16

A company is migrating a monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single Compute Engine instance and stores session state in local memory. The migration must support horizontal scaling and high availability. What should the company do to manage session state in the new architecture?

Accepted Answer

Refactor the application to store session state in Cloud Memorystore for Redis and make the application stateless.. Migrating to a stateless architecture with Cloud Memorystore for Redis allows the application to scale horizontally without session state being tied to any single pod. By externalizing session state to a managed, highly available Redis service, any pod can handle any request, which is essential for high availability and autoscaling in GKE.

Answer

Use a StatefulSet with a headless service to assign stable network identities to pods.

Answer

Use GKE Ingress with session affinity (sticky sessions) to route requests to the same pod.

Answer

Store session state in Cloud SQL using a replicated database.

Question 17

A media company wants to serve publicly available images and videos to a global audience with low latency. Which Google Cloud service should they primarily use?

Accepted Answer

Cloud CDN with Cloud Storage as the origin.. Cloud CDN with Cloud Storage as the origin is the correct choice because it uses Google's global edge cache to serve publicly available images and videos from Cloud Storage, minimizing latency for a global audience. Cloud CDN caches content at edge locations worldwide, reducing the round-trip time to the origin bucket, while Cloud Storage provides scalable, durable object storage. This combination is purpose-built for delivering static content with low latency and high throughput.

Answer

Cloud Storage with public bucket serving the files.

Answer

Cloud Run with a container that serves the files.

Answer

Compute Engine with an HTTP server.

Question 18

A media streaming company wants to serve video content globally with low latency. They plan to cache static objects (thumbnails, manifest files) at edge locations, while dynamic API requests are handled by a backend in a single region. Which combination should they use?

Accepted Answer

Cloud CDN with an external HTTP(S) load balancer. Cloud CDN caches static content at Google's edge locations, reducing latency for global users. An external HTTP(S) Load Balancer routes traffic, terminates SSL, and directs dynamic API requests to the backend. Cloud CDN is enabled on the backend bucket or backend service. Internal LB is for internal traffic only. Cloud NAT is for outbound traffic. VPC peering does not cache.

Answer

Cloud CDN with an internal TCP/UDP load balancer

Answer

Cloud Armor with a TCP/SSL proxy load balancer

Answer

VPC peering with Cloud NAT

Question 19

A company is running a containerized application on Cloud Run and needs to handle long-running requests that may exceed Cloud Run's default timeout. They also need to use WebSocket connections. What should they do?

Accepted Answer

Move WebSocket connections to Compute Engine and adjust Cloud Run timeout to 60 minutes for long requests.. Cloud Run allows configuring request timeout up to 60 minutes. However, WebSocket support is limited; Cloud Run does not support WebSocket connections natively. For WebSocket, they should consider GKE or Compute Engine. Thus, the correct answer is to adjust Cloud Run timeout max and move WebSocket to another service.

Answer

Use Cloud Functions with a HTTP trigger and increase the timeout to 60 minutes.

Answer

Deploy the application on Google Kubernetes Engine (GKE) with a NodePort service to handle WebSocket natively.

Answer

Increase the Cloud Run container timeout to the maximum (60 minutes) and enable WebSocket support by setting an environment variable.

Question 20

A company deploys a stateful workload using StatefulSets on GKE. They want to ensure that if a pod is evicted, its persistent volume claim (PVC) is reattached to the replacement pod in the same zone. Which configuration achieves this?

Accepted Answer

Use a StatefulSet with a volumeClaimTemplate referencing a persistent disk in the same zone.. StatefulSets are designed for stateful workloads and guarantee stable network identities and persistent storage. When a pod is evicted, the StatefulSet controller ensures the replacement pod uses the same PVC, which is bound to a GCE Persistent Disk in the same zone as the original pod, provided the volumeClaimTemplate specifies a disk in that zone. This maintains data locality and avoids cross-zone reattachment.

Answer

Use a Deployment with a PVC that has allowedTopologies restricting to the desired zone.

Answer

Use a Deployment with a persistent volume that is manually attached after pod creation.

Answer

Use a StatefulSet with a persistent disk that has access mode ReadOnlyMany.