Google PCA Practice Exam 60 — 20 Questions

Question 1

Your team manages a service with a 99.9% uptime SLO over a 30-day window. The error budget for this period is 43 minutes. In the first week, outages consumed 30 minutes of the budget. You are planning a new release. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delay the release and focus on improving reliability to rebuild the error budget.. With only 13 minutes of error budget remaining after the first week, proceeding with the release (Option B) risks exhausting the budget entirely from any unforeseen issues, violating the 99.9% SLO. Delaying the release (Option C) allows the team to focus on reliability improvements, such as implementing canary deployments, adding circuit breakers, or enhancing monitoring with tools like Prometheus and Grafana, to rebuild the error budget over the remaining 23 days. This aligns with the principle of using error budgets to balance innovation with reliability, as defined in Google's SRE practices.

Answer

Reduce the SLO to 99.8% to increase the error budget.

Answer

Proceed with the release because the remaining budget is sufficient.

Answer

Release the feature but only to a small percentage of users.

Question 2

A company is migrating 500 TB of on-premises file server data to Cloud Storage. The on-premises network has a 1 Gbps link to Google Cloud, but the migration must complete within 30 days. What is the MOST cost-effective and reliable method?

Accepted Answer

Use Transfer Appliance. Transfer Appliance is a physical device that Google ships to the customer; they load data onto it and return it for upload. For 500 TB over a 1 Gbps link, the theoretical transfer time is ~46 days (500 TB * 8 / 1 Gbps / 86400 sec/day), exceeding the 30-day window. Transfer Appliance avoids network transfer and meets the timeline. Storage Transfer Service is for cloud-to-cloud or HTTP(S) sources, not on-prem. Migrate for Compute Engine is for VM migration.

Answer

Use Storage Transfer Service over a dedicated interconnect

Answer

Deploy a VPN and use gsutil rsync

Answer

Use Database Migration Service

Question 3

You are deploying a stateless web application on Compute Engine. Which TWO actions improve availability? (Choose 2)

Accepted Answer

Use a regional managed instance group.. A regional managed instance group (MIG) distributes instances across multiple zones within a region, ensuring that if one zone fails, traffic is automatically routed to healthy instances in other zones. This provides high availability by eliminating a single zone of failure, which is critical for stateless web applications that can serve requests from any instance.

Answer

Enable Cloud CDN for the static content.

Answer

Purchase 1-year committed use contracts for the instances.

Answer

Use preemptible VMs to reduce cost.

Question 4

Refer to the exhibit. The log entry is from Cloud Logging for a VPC subnetwork. What is the most likely cause of this error?

Accepted Answer

A firewall rule blocking ingress on port 80.. The log entry indicates a packet was dropped by a firewall rule. Since the destination is 10.0.0.2 on port 80 (HTTP), the most likely cause is a firewall rule blocking ingress traffic on port 80. In Google Cloud VPC, firewall rules are stateful and evaluated before any routing decisions, so a missing or misconfigured ingress rule for TCP port 80 would cause this drop.

Answer

The subnetwork default has no internet gateway.

Answer

The VM at 10.0.0.2 is not running.

Answer

The packet is malformed.

Question 5

You are reviewing an IAM policy for a Cloud Storage bucket. Alice is a member of the data-team group. What level of access does Alice have to objects in this bucket?

Accepted Answer

Read and write access (admin).. The IAM policy grants the data-team group the roles/storage.objectAdmin role, which provides full read, write, and delete access to objects in the bucket. Alice, as a member of the data-team group, inherits this role and therefore has read and write (admin) access to the objects.

Answer

Read-only access.

Answer

No access, because the group policy overrides the individual policy.

Answer

Write-only access.

Question 6

A company deploys a web application on Compute Engine behind an HTTP Load Balancer. They want to ensure only healthy instances receive traffic. What should they configure?

Accepted Answer

Configure an HTTP health check with a custom request path that returns a 200 status. An HTTP health check with a custom request path that returns a 200 status allows the HTTP Load Balancer to verify that the web application is actually serving requests correctly. This ensures that only instances passing the application-level health check are considered healthy and receive traffic, preventing requests from being routed to instances that may be running but not serving the expected content.

Answer

Configure the instance group autoscaling based on CPU utilization

Answer

Configure a TCP health check on port 80

Answer

Configure an SSL health check to verify TLS handshake

Question 7

A company has a microservices architecture on GKE. One service is failing due to resource exhaustion. How can they proactively prevent this?

Accepted Answer

Configure a horizontal pod autoscaler with custom metrics.. A horizontal pod autoscaler with custom metrics (e.g., memory, request queue depth) can detect resource exhaustion early and scale pods before failure. Option A (vertical pod autoscaling) may not react fast enough or may not scale horizontally, which is needed for stateless microservices. Option B (CPU-based autoscaling) may not capture all types of resource exhaustion (e.g., memory leaks). Option D (cluster autoscaler) scales nodes, not pods, so it does not directly address pod-level resource exhaustion.

Answer

Use vertical pod autoscaling.

Answer

Set up autoscaling based on CPU utilization.

Answer

Implement a cluster autoscaler.

Question 8

A company runs a data analytics platform on Google Cloud using BigQuery, Dataflow, and Cloud Storage. They notice that Dataflow jobs are failing with 'out of memory' errors for certain large pipelines. The pipelines process variable amounts of data, sometimes spiking 10x normal. Which strategy should they use to handle these spikes cost-effectively?

Accepted Answer

Configure the Dataflow pipeline to use autoscaling with a higher maximum number of workers and use preemptible VMs for cost savings.. Dataflow's autoscaling can dynamically add workers to handle sudden data spikes, and using preemptible VMs significantly reduces cost for batch pipelines that can tolerate interruptions. This approach avoids manual intervention and over-provisioning, making it cost-effective for variable workloads.

Answer

Manually monitor the job and increase the number of workers when a spike is detected.

Answer

Increase the machine type of the workers to a high-memory type and disable autoscaling.

Answer

Use Dataflow Streaming Engine to offload state to persistent storage and reduce memory usage.

Question 9

You are designing a high-availability architecture for a global e-commerce platform that uses Cloud SQL for MySQL as the primary database. The application writes to a single Cloud SQL instance in us-central1 and reads from read replicas in us-central1 and us-west1. During a recent regional outage in us-central1, the primary instance became unavailable, and the application experienced full downtime for 3 hours because the failover to a read replica was not automatic. The application can tolerate up to 10 minutes of data loss but needs to recover within 30 minutes. You need to automate failover to a geographically distant region with minimal manual intervention. The application's connection string must not change. Which solution meets these requirements?

Accepted Answer

Create a cross-region read replica in us-west1, use a Cloud Load Balancing with a static IP that maps to the primary or promoted replica, and automate monitoring and failover via Cloud Functions. It uses a cross-region read replica in us-west1 combined with a static IP via Cloud Load Balancing, which allows the connection string to remain unchanged after failover. Cloud Functions automate the monitoring and promotion of the replica, meeting the 30-minute recovery and 10-minute data loss tolerance. This design ensures failover to a geographically distant region with minimal manual intervention, unlike single-zone or same-region HA configurations.

Answer

Set up a Cloud SQL for MySQL high-availability configuration across zones within us-central1

Answer

Configure an external read replica in us-west1 and manually promote it using gcloud commands during an incident

Answer

Enable automatic failover by creating a Cloud SQL for MySQL regional failover replica in us-central1

Question 10

A company wants to improve the reliability of their microservices architecture on Google Cloud. Which TWO practices should they implement? (Choose 2)

Accepted Answer

Implement retry with exponential backoff. B is correct because implementing retry with exponential backoff allows transient failures (e.g., network timeouts, temporary service unavailability) to be handled gracefully by automatically retrying the request after increasing delays, reducing load on the recovering service. This pattern is essential in microservices on Google Cloud to improve reliability without overwhelming downstream dependencies.

Answer

Design with a single point of failure for simplicity

Answer

Use synchronous communication between all services

Answer

Disable health checks to reduce latency

Question 11

A company is designing a data pipeline to ingest streaming data from IoT devices and store it in BigQuery for analysis. They need to minimize latency and operational overhead. Which two Google Cloud services should they use? (Choose two.)

Accepted Answer

Cloud Dataflow. Cloud Pub/Sub is the recommended service for ingesting streaming data, and Cloud Dataflow can process the data and write it directly to BigQuery with low latency. Cloud Storage is for batch uploads, Cloud Functions is event-driven but not ideal for high-throughput streaming, and Cloud Dataproc is for batch processing.

Answer

Cloud Dataproc

Answer

Cloud Storage

Answer

Cloud Functions

Question 12

Your company runs a stateless web application on Compute Engine. You want to ensure that if a zone fails, the application continues to serve traffic with minimal manual intervention. What should you do?

Accepted Answer

Create a regional managed instance group with an autoscaling policy and use a global Cloud Load Balancer.. A regional managed instance group (MIG) distributes instances across multiple zones within a region, ensuring that if one zone fails, the remaining zones continue serving traffic. Combined with a global Cloud Load Balancer, traffic is automatically routed to healthy instances in any zone, providing high availability with minimal manual intervention. Autoscaling further ensures that new instances are created to handle load, even if a zone becomes unavailable.

Answer

Schedule regular snapshots of each instance's persistent disk to a regional bucket.

Answer

Use a global Cloud Load Balancer and enable Cloud CDN.

Answer

Create an instance template and manually deploy instances in another zone.

Question 13

The exhibit shows a managed instance group configuration. What is the primary purpose of the 'autoHealingPolicies' section?

Accepted Answer

Automatically replace instances that are deemed unhealthy based on the health check.. The 'autoHealingPolicies' section in a managed instance group configuration is specifically designed to automatically replace instances that are deemed unhealthy based on a configured health check. When a health check probe (e.g., HTTP, TCP, or SSL) fails for a sustained period, the managed instance group terminates the unhealthy instance and creates a new one from the instance template, ensuring the desired number of healthy instances is maintained. This is distinct from autoscaling, which adjusts instance count based on load metrics.

Answer

Distribute incoming traffic evenly across the instances.

Answer

Automatically add more instances when CPU utilization exceeds 60%.

Answer

Automatically update instances to a new instance template.

Question 14

Refer to the exhibit. A GKE cluster named 'prod-cluster' has network policy enabled with Calico. A deployment in the cluster uses a ServiceAccount that needs to pull images from a private Container Registry in the same project. Despite correct configuration of ImagePullSecrets, pods fail to pull images with 'AccessDenied' errors. What is the most likely cause?

Accepted Answer

The node service account lacks storage.objectViewer role on the registry bucket.. The node's service account (the GCE default service account or the one assigned to the cluster nodes) must have the `storage.objectViewer` role on the Container Registry's underlying Cloud Storage bucket. Even with correct ImagePullSecrets, the kubelet on each node uses the node's service account to authenticate with the registry when pulling images. Without this role, the node cannot read the image layers from the bucket, resulting in 'AccessDenied' errors.

Answer

The ImagePullSecret is not correctly base64-encoded.

Answer

The network policy blocks egress traffic to the Container Registry's endpoints.

Answer

The cluster's private cluster feature prevents access to external registries.

Question 15

A startup wants to encrypt data at rest in Cloud Storage using Customer-Managed Encryption Keys (CMEK). They have already created a Cloud KMS key ring and key. What additional step is required to enable CMEK for a new Cloud Storage bucket?

Accepted Answer

Grant the Cloud Storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.. To use CMEK with Cloud Storage, the Cloud Storage service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key. This permission allows the bucket's underlying storage system to encrypt and decrypt objects using the customer-managed key. Without this IAM binding, the bucket cannot access the key, and CMEK operations will fail.

Answer

Enable the Cloud KMS API in the project where the bucket will reside.

Answer

Create a Cloud HSM key instead, as CMEK requires HSM.

Answer

Add a label to the key ring to associate it with the bucket.

Question 16

A company needs to store archival data that is accessed less than once a year, with retrieval times of up to 12 hours acceptable. The data must be kept for 10 years for compliance. What is the most cost-effective Cloud Storage solution?

Accepted Answer

Cloud Storage Archive class with a lifecycle policy that deletes objects after 10 years. Cloud Storage Archive class is the most cost-effective option for data accessed less than once a year with retrieval times up to 12 hours, as it offers the lowest storage cost among Google Cloud Storage classes. A lifecycle policy that deletes objects after 10 years ensures compliance with the retention requirement without incurring ongoing storage costs beyond the mandated period.

Answer

Cloud Storage Coldline class with a retention policy

Answer

Cloud Storage Nearline class

Answer

Cloud Storage Standard class with object versioning

Question 17

A company is migrating a large on-premises data warehouse to BigQuery. The data includes sensitive customer information that must be encrypted at rest and in transit. They also need to mask credit card numbers for analysts who do not have a need to see the full number. Which TWO Google Cloud services should they use? (Choose 2.)

Accepted Answer

Cloud Data Loss Prevention (DLP). BigQuery supports column-level security via policy tags using Data Catalog. Data Loss Prevention (DLP) can automatically classify and mask sensitive data such as credit card numbers. Cloud Key Management Service (KMS) is for managing encryption keys but not for masking. Cloud Audit Logs are for auditing, not masking. Cloud Identity-Aware Proxy (IAP) controls access at the application level, not for data masking.

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Cloud Audit Logs

Answer

Cloud Key Management Service (KMS)

Question 18

A company is running a multi-region application on Google Kubernetes Engine with workloads in us-central1 and europe-west1. They want to route traffic to the closest region based on user location. Which three components should they configure? (Choose three.)

Accepted Answer

Cloud DNS with geo-routing policy. Cloud DNS geo-routing policy directs DNS queries to the closest healthy backend based on the user's geographic location, enabling traffic to be routed to the nearest GKE region (us-central1 or europe-west1). This is essential for minimizing latency and optimizing user experience in a multi-region setup.

Answer

Cloud Armor security policy

Answer

Regional internal load balancer

Question 19

Which THREE are valid methods to connect an on-premises network to a Google Cloud VPC?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (A) provides a direct physical connection between your on-premises network and Google Cloud, offering high bandwidth and a Service Level Agreement (SLA) of up to 99.99% availability. It uses a cross-connect in a colocation facility to attach your on-premises router to a Google Cloud router, enabling private, low-latency connectivity to your VPC without traversing the public internet.

Answer

Cloud Router

Answer

VPC peering

Question 20

A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?

Accepted Answer

Use Cloud Armor security policies with geographic-based denylist rules.. Cloud Armor security policies support geographic-based access control using denylist or allowlist rules that match client IP addresses against country-level geolocation data. This allows the security team to block traffic from specific countries at the edge, before it reaches the backend, which is the most efficient and compliant approach for GDPR enforcement.

Answer

Configure Cloud CDN to serve content only to EU-based users.

Answer

Set VPC firewall rules to allow traffic only from EU IP ranges.

Answer

Configure Identity-Aware Proxy (IAP) to require user authentication from allowed countries.