Google PCA Practice Test 6 — 10 Questions

Question 1

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage. Enabling CMEK on Cloud SQL and Cloud Storage allows the company to use their own encryption keys, which is often required by PCI DSS to demonstrate control over key management. CMEK ensures data at rest is encrypted with keys managed via Cloud KMS, providing auditability and separation of duties beyond Google-managed default encryption.

Answer

Configure client-side encryption in the application code

Answer

Rely on Google-managed default encryption for all data

Answer

Use Cloud HSM with a key generated outside of Google Cloud

Question 2

Your organization is moving a legacy monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single virtual machine with a local MySQL database. You need to design a cloud-native architecture that improves scalability and reliability. Which two actions should you take? (Choose TWO.)

Accepted Answer

Refactor the application into microservices and deploy each as a separate deployment in GKE.. Refactoring the monolithic application into microservices and deploying each as a separate Deployment in GKE aligns with cloud-native principles, enabling independent scaling, fault isolation, and easier updates. This approach improves scalability and reliability by allowing each microservice to scale horizontally based on demand, and failures in one service do not cascade to others.

Answer

Deploy the entire application in a single container with a large custom machine type to handle load.

Answer

Expose the application using a simple Service of type LoadBalancer with round-robin distribution.

Answer

Use a single Pod with multiple containers that communicate via localhost to reduce latency.

Question 3

Your company uses HA VPN to connect on-premises to Google Cloud. You need to ensure the VPN connection meets a 99.99% SLA. Which configuration is required?

Accepted Answer

Two Cloud VPN gateways in different regions, each with two tunnels to the same on-premises peer gateway.. HA VPN provides 99.99% SLA when configured with two Cloud VPN gateways (one per region) and two tunnels per gateway (four tunnels total) from each gateway to the on-premises peer gateway. Each gateway uses a different external IP. A single VPN gateway with two tunnels does not meet the SLA requirement because the gateway itself is a single point of failure.

Answer

A single Cloud VPN gateway with two tunnels to the same on-premises peer gateway.

Answer

Two Cloud VPN gateways in the same region, each with one tunnel.

Answer

One Cloud VPN gateway with four tunnels to the same on-premises peer gateway.

Question 4

A company needs to store archival data that is accessed less than once a year. They want the lowest storage cost possible, but they can accept a retrieval time of up to 24 hours. Which Cloud Storage class should they use?

Accepted Answer

Archive. Archive storage is the lowest-cost storage class for long-term archival with retrieval times in hours (typically 24 hours). Coldline is for data accessed less than once a quarter. Nearline is for monthly access. Standard is for frequently accessed data.

Answer

Nearline

Answer

Standard

Answer

Coldline

Question 5

A company runs a critical application on Compute Engine that must remain available even if an entire zone fails. They have configured a managed instance group across three zones with autoscaling based on CPU utilization. The application state is stored in a Cloud SQL instance. Which additional step should they take to ensure high availability?

Accepted Answer

Configure a regional Cloud SQL instance with primary and standby in different zones.. Cloud SQL provides high availability with a standby instance in a different zone using regional persistent disk. This ensures failover if the primary zone fails.

Answer

Use a Cloud Load Balancer in front of the managed instance group.

Answer

Deploy a read replica of the Cloud SQL instance in another region.

Answer

Take frequent snapshots of the boot disk and store them in a multi-regional bucket.

Question 6

A company runs a batch processing workload on Compute Engine instances in a managed instance group (MIG). The job is CPU-intensive and takes approximately 4 hours to complete. The company wants to reduce costs without sacrificing performance. Which action should they take?

Accepted Answer

Use preemptible VMs for the MIG and implement a checkpointing mechanism to handle interruptions.. Preemptible VMs are significantly cheaper than standard VMs but can be terminated at any time. For a batch processing workload that is CPU-intensive and runs for 4 hours, using preemptible VMs in a MIG with a checkpointing mechanism allows the job to resume from the last saved state after an interruption, thus reducing costs without sacrificing performance.

Answer

Purchase committed use discounts for the instance type.

Answer

Change the machine series to a smaller machine type.

Answer

Provision additional reserved VMs to ensure capacity.

Question 7

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

Accepted Answer

Implement VPC Service Controls with a service perimeter. VPC Service Controls use service perimeters to protect resources and prevent data exfiltration from authorized networks, including GKE clusters, to external resources.

Answer

Configure firewall rules to block outbound traffic to Cloud Storage

Answer

Enable Cloud Armor on the GKE cluster

Answer

Use Private Google Access for on-premises access

Question 8

You are the lead cloud architect for a startup that runs a web application on Google Kubernetes Engine (GKE) with a standard (zonal) cluster. The application is deployed with 3 replicas of a stateless frontend service. During a recent incident, a zone outage caused all GKE nodes to become unavailable, leading to application downtime of 45 minutes. You need to redesign the cluster to tolerate a single zone failure with no more than 5 minutes of downtime. Your budget allows for at most a 20% increase in compute costs. Which approach should you take?

Accepted Answer

Migrate the cluster to a regional GKE cluster with nodes in 3 zones and distribute replicas across zones. D is correct because a regional GKE cluster distributes nodes across three zones, ensuring that if one zone fails, the remaining two zones continue serving traffic. By spreading the 3 replicas across zones (e.g., one per zone), the application tolerates a single zone outage with near-zero downtime, and the 20% cost increase covers the additional node pool overhead without exceeding the budget.

Answer

Increase the number of replicas from 3 to 9 and keep the zonal cluster

Answer

Change the frontend deployment to use regional persistent disks

Answer

Deploy second GKE cluster in another region and use global load balancer for failover

Question 9

A developer needs to secure secrets (API keys, passwords) used in a Cloud Function. What is the recommended approach?

Accepted Answer

Use Secret Manager. Secret Manager is the recommended approach for securing sensitive data like API keys and passwords in Cloud Functions because it provides encrypted storage, fine-grained access control via IAM, and automatic rotation. Unlike environment variables, which are visible in the Cloud Console and logs, Secret Manager ensures secrets are never exposed in plaintext and are injected securely at runtime.

Answer

Store secrets in environment variables

Answer

Store in Cloud Storage and download at runtime

Answer

Hard-code in the function code

Question 10

A company needs to choose between Cloud Spanner and Firestore for a global inventory application that requires strong consistency and horizontal scaling. The application has a fixed schema with complex joins. Which database is most appropriate?

Accepted Answer

Cloud Spanner. Cloud Spanner is a globally distributed relational database with strong consistency and supports complex joins. Firestore is a NoSQL document database with eventual consistency (strong consistency only within a single document).

Answer

Firestore

Answer

Cloud SQL

Answer

Cloud Bigtable