Google PCA Practice Test 6 — 10 Questions

Question 1

An application uses Cloud Bigtable and experiences high latency for reads. The row key is a timestamp prefix followed by a random ID. Queries often scan a range of timestamps for a specific ID. What design change would MOST improve read performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the row key to start with the random ID followed by timestamp. For Bigtable, row key design is critical. Scanning a range of timestamps for a specific ID is inefficient if the key starts with timestamp (scans across all IDs). Prepending the ID ensures all data for that ID is contiguous, making range scans efficient. Adding nodes increases throughput but doesn't fix the key design issue. Using a column family is about grouping columns, not performance.

Answer

Add more Bigtable nodes

Answer

Use a separate column family for the ID

Answer

Enable Bigtable replication

Question 2

A company is designing a highly available architecture for a stateful application on Compute Engine. They need to protect against zonal failures. Which THREE steps should they take?

Accepted Answer

Use a global load balancer with health checks. Option B is correct because a global external Application Load Balancer (or global external proxy Network Load Balancer) with health checks distributes traffic across healthy backends in multiple zones and automatically stops routing to unhealthy instances, providing resilience against a zonal failure. Option D is correct because regional persistent disks synchronously replicate data between two zones in the same region, so a stateful application's data remains available if one zone fails. Option E is correct because a managed instance group (MIG) spread across multiple zones maintains capacity and automatically recreates instances in surviving zones when a zone becomes unavailable. Option A is wrong because storing session state only in memory ties the state to a single instance and is lost on failure, breaking high availability. Option C is wrong because a single-zone instance group has no protection against a zonal outage.

Answer

Store session state in memory

Answer

Use a single zone instance group

Question 3

A company stores infrequently accessed data in Cloud Storage Standard class. To reduce costs, they want to automatically move objects older than 90 days to a lower-cost storage class. Which approach should they use?

Accepted Answer

Configure a lifecycle policy to transition to Archive class. Object Lifecycle Management in Cloud Storage is designed exactly for this use case: automatically transitioning objects to lower-cost storage classes based on age or other conditions. Configuring a lifecycle rule to transition objects older than 90 days to the Archive class (A) reduces cost while preserving durability and access when needed. Lifecycle policies run asynchronously and are the standard, supported mechanism for automated class transitions.

Answer

Use gsutil rewrite to manually change storage class

Answer

Set up Pub/Sub notifications for object changes

Answer

Enable object versioning

Question 4

A retail company runs a Java-based order service on Compute Engine. The service currently reads its database credentials from a plaintext file on the boot disk. A security review requires that the credentials be removed from disk, be automatically rotated every 30 days, and be retrievable by the application through a single API call. You want the least operational overhead. What should you do?

Accepted Answer

Store the credential as a version in Secret Manager, grant the VM's service account roles/secretmanager.secretAccessor on that secret, and configure a rotation schedule that publishes to a Pub/Sub topic.. The requirements point to a managed secret store with per-secret IAM and built-in rotation. Secret Manager keeps the credential off disk, lets the application retrieve it with one API call, and supports a rotation schedule that notifies a Pub/Sub topic so an automated workflow can update the underlying database password. Object storage, metadata, and KMS-wrapped files all leave the credential materialized on the instance or require custom rotation logic.

Answer

Encrypt the credentials file with a Cloud KMS key, keep it on the boot disk, and grant the VM's service account roles/cloudkms.cryptoKeyDecrypter so the application can decrypt it at startup.

Answer

Store the credentials in a Cloud Storage bucket with uniform bucket-level access and grant the VM's service account roles/storage.objectViewer, then have the application download the file at startup.

Answer

Store the credential in a custom metadata key on the instance and grant the VM's service account the compute.instanceAdmin.v1 role so it can read its own metadata.

Question 5

A developer wants to store a database password securely and have it automatically rotated every 30 days. The password is used by a Compute Engine instance. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing, versioning, and rotating secrets such as database passwords, API keys, and certificates. It supports automatic rotation via Cloud Functions or Pub/Sub triggers on a schedule (e.g., every 30 days), and Compute Engine instances can retrieve secrets at runtime using the Secret Manager API with IAM-controlled access. This directly satisfies both the secure storage and automatic rotation requirements.

Answer

Cloud Storage with customer-supplied encryption keys

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Environment variables in Compute Engine

Question 6

A company runs a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage and low-latency access across multiple zones. The application needs to perform well even during zonal failures. Which storage solution should they use?

Accepted Answer

Regional persistent disk. Regional persistent disks (RPDs) synchronously replicate data across two zones in the same region, providing both the persistent storage and low-latency access required by the stateful application. This ensures that if one zone fails, the disk can be attached to a pod in the surviving zone without data loss or significant performance degradation, meeting the high-availability and multi-zone access requirements.

Answer

Zonal persistent disk with snapshots to another zone

Answer

Local SSDs attached to nodes

Answer

Cloud Filestore

Question 7

A security admin wants to audit all 'create' and 'delete' operations on Compute Engine instances in a project for the last 90 days. Which type of audit log should they query?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all write operations (create, update, delete) on project resources, including Compute Engine instances, and are always enabled with a 400-day retention. Querying Admin Activity logs for the last 90 days will show all create and delete operations on instances. Data Access logs, by contrast, record read operations and are disabled by default.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 8

A company is deploying a web application on Compute Engine. They want to automatically scale the number of instances based on CPU utilization. Which two components are required to set up autoscaling? (Choose two.)

Accepted Answer

Instance template. Option C (Instance template) is correct because a managed instance group requires an instance template to define the machine type, boot disk image, network, and other configuration used when automatically creating new VM instances during scaling. Option D (Managed instance group) is correct because autoscaling in Compute Engine operates on a managed instance group (MIG), where the autoscaler adds or removes instances based on the specified CPU utilization target. Cloud Functions (A) is a serverless event-driven compute service and plays no role in Compute Engine autoscaling. Cloud Load Balancing (B) is commonly used to distribute traffic to the instances but is not a required component to configure the autoscaling policy itself. Cloud Monitoring (E) can surface metrics and alerts, but the autoscaler uses the MIG's built-in CPU utilization signal and does not require a separate Monitoring configuration.

Answer

Cloud Functions

Answer

Cloud Load Balancing

Answer

Cloud Monitoring

Question 9

Which TWO statements are true about Google Cloud VPC networks? (Select exactly 2.)

Accepted Answer

Subnets are regional resources and can span zones.. Google Cloud VPC subnets are regional resources that can span multiple zones within the same region. This allows resources in different zones to use the same subnet without requiring additional routing or VPN configuration, providing high availability and fault tolerance within a region.

Answer

Each VPC network is regional in scope.

Answer

By default, no firewall rules are created in a new VPC.

Answer

VPC Peering supports transitive routing.

Question 10

A global gaming company deploys a leaderboard service using Cloud Spanner with a single-region configuration. They need a Recovery Point Objective (RPO) of 5 seconds and a Recovery Time Objective (RTO) of 1 minute in the event of a regional outage. What should they do?

Accepted Answer

Deploy Cloud Spanner in a multi-region configuration.. Cloud Spanner multi-region configuration replicates data synchronously across regions and provides automatic failover with strong consistency, meeting an RPO of 5 seconds and RTO of 1 minute for a regional outage. A single-region Spanner instance does not survive a regional failure, so moving to multi-region is the correct fix. Multi-region also preserves the leaderboard's low-latency reads and writes globally.

Answer

Set up a cross-region read replica using Cloud SQL.

Answer

Use Compute Engine instances in multiple zones with a global load balancer to replicate data.

Answer

Configure cross-region backups with a 5-second recovery window.