Google PCA Practice Exam 61 — 20 Questions

Question 1

A company runs a web application on Compute Engine with an HTTP Load Balancer. Users report intermittent 502 Bad Gateway errors. What is the most likely cause?

Accepted Answer

Backend instances are unhealthy or overloaded.. The 502 Bad Gateway error from an HTTP Load Balancer typically indicates that the backend instances are failing to respond to the load balancer's health checks or are overwhelmed, causing the load balancer to consider them unhealthy and return a 502 error. This is the most common cause because the load balancer relies on healthy backends to forward traffic, and overloaded or failing instances cannot handle requests.

Answer

Load balancer quota exceeded.

Answer

Firewall rules block health checks.

Answer

SSL certificate expired.

Question 2

An organization needs to comply with FedRAMP requirements and restrict data storage to specific regions. They also need to audit all admin activities and data access. Which three components should they implement? (Choose three.)

Accepted Answer

Data Access audit logs. Assured Workloads enforces compliance controls (e.g., region restrictions). Admin Activity audit logs capture administrative actions, and Data Access audit logs capture data reads/writes for compliance.

Answer

VPC Service Controls

Answer

Cloud Armor

Question 3

An organization needs to run a stateful application on Google Kubernetes Engine (GKE) where the nodes are fully managed by Google and the application workload SLAs are guaranteed. They want to minimize operational overhead. Which GKE mode should they use?

Accepted Answer

GKE Autopilot. GKE Autopilot manages the entire node infrastructure including node provisioning, scaling, and maintenance. It provides workload-level SLAs (e.g., 99.95% for pods). Standard mode requires the user to manage node pools.

Answer

GKE Standard with Cluster Autoscaler

Answer

GKE Standard with node auto-provisioning

Answer

GKE Standard with sole-tenant nodes

Question 4

An application running on Compute Engine instances behind a load balancer experiences intermittent failures. Health checks show instances passing, but some users get errors. What should be the first troubleshooting step?

Accepted Answer

Review the application logs for errors.. The correct first step is to review the application logs (Option B) because the issue is intermittent failures despite healthy load balancer health checks. Since health checks confirm the instances are reachable and responding correctly at the health check endpoint, the problem likely lies within the application itself—such as request handling errors, timeouts, or resource contention. Application logs provide the most direct evidence of what is happening when users encounter errors, enabling targeted debugging before modifying infrastructure.

Answer

Increase instance size.

Answer

Enable HTTP health checks.

Answer

Check the load balancer's backend service configuration for session affinity.

Question 5

A financial services company must meet PCI DSS compliance requirements for a Google Kubernetes Engine (GKE) cluster processing credit card data. Which TWO actions are required to help achieve PCI DSS compliance? (Choose two.)

Accepted Answer

Enable Shielded GKE nodes.. Shielded GKE nodes provide verifiable integrity of the node's operating system and boot process, which is essential for PCI DSS requirements related to protecting cardholder data against tampering. Shielded nodes use UEFI firmware, Secure Boot, and measured boot to ensure that only signed and trusted software runs on the node, helping to meet the 'Protect Cardholder Data' and 'Maintain a Vulnerability Management Program' objectives.

Answer

Enable GKE Dataplane V2 for network policy enforcement.

Answer

Configure Cloud Audit Logs for the cluster.

Answer

Use GKE Sandbox for all untrusted workloads.

Question 6

A team manages a GKE cluster with node pools using different machine types. They plan to upgrade the cluster to a new Kubernetes version. What is the safest upgrade strategy to minimize application downtime?

Accepted Answer

Use a surge upgrade to add new nodes before removing old ones.. A surge upgrade in GKE adds new nodes with the desired Kubernetes version before removing old nodes, ensuring capacity is maintained throughout the process. This minimizes application downtime by allowing pods to be rescheduled onto new nodes before old nodes are drained, following a controlled rolling update pattern that respects PodDisruptionBudgets.

Answer

Perform a rolling upgrade by draining all nodes simultaneously.

Answer

Create a new cluster with the desired version and migrate workloads.

Answer

Upgrade the node pool configuration one by one.

Question 7

Refer to the exhibit. A user reports that the instance 'batch-vm' is unavailable. Based on the output, what is the most likely cause of the unavailability?

Accepted Answer

The preemptible VM was terminated by Google due to its preemptible nature.. The exhibit shows the instance 'batch-vm' with a status of 'TERMINATED' and the 'preemptible' flag set to 'true'. Preemptible VMs in Google Cloud have a maximum runtime of 24 hours and can be terminated at any time by Google Compute Engine due to resource constraints. The termination reason is typically 'preemption', which matches the scenario of a user reporting unavailability without manual intervention.

Answer

The VM was stopped manually by a user.

Answer

The VM lost its external IP address.

Answer

The VM crashed due to an out-of-memory error.

Question 8

A team is migrating a monolithic application to microservices on GKE. They want to gradually shift users to the new microservices version while keeping the old monolithic version running. They need to route a small percentage of users based on a cookie. Which traffic management approach should they use?

Accepted Answer

Use Istio VirtualService with match rules based on cookie and weighted destinations. Istio traffic management allows fine-grained routing based on HTTP headers, cookies, or other attributes. It supports traffic splitting and canary deployments with precise percentage control.

Answer

Use Kubernetes Services with multiple Deployments and manual scaling

Answer

Configure an HTTP(S) load balancer with URL maps and backend services

Answer

Deploy two separate GKE clusters and use DNS-based traffic splitting

Question 9

A company uses Cloud Bigtable for time-series data. They experience high latency and uneven load distribution across nodes. What is the most likely cause?

Accepted Answer

The table has a single row key pattern that causes hot spotting. Cloud Bigtable partitions data by row key range and distributes tablets across nodes. A single row key pattern (e.g., monotonically increasing timestamps) causes all writes to target the same tablet, creating a hot spot. This leads to uneven load distribution and high latency because one node is overwhelmed while others remain idle.

Answer

The data is stored in a single column family

Answer

The app is using strong reads instead of eventual consistency

Answer

The cluster has too many nodes

Question 10

A company runs multiple microservices on Cloud Run. Each service uses a Serverless VPC Access connector to connect to a shared Cloud Memorystore for Redis instance (standard tier) in a VPC network. The Redis instance is configured with a firewall rule that allows TCP connections on port 6379 from the VPC connector's subnet (10.8.0.0/28). After a recent code update, the order-service fails to connect to Redis, while the user-service continues to work. The error logs in order-service show 'connection refused'. The engineer verifies that both services use the same VPC connector, the same Redis instance IP, and the same service account. The VPC connector's metrics show no errors. What is the most likely cause?

Accepted Answer

The order-service code now attempts to connect to Redis on port 6380.. The order-service successfully connects to the same Redis instance before the code update. After the update, it fails with 'connection refused', while the user-service still works. Since both services share the same networking configuration and the firewall only allows port 6379, the most likely cause is that the order-service code now attempts to connect on a different port (e.g., 6380) that is not allowed by the firewall. Other options would affect both services or are inconsistent with the symptoms.

Answer

The order-service is deployed in a different region than the Redis instance.

Answer

The VPC connector is out of memory.

Answer

The Redis instance has reached its maximum number of connections.

Question 11

Match each GCP security service to its function.

Accepted Answer

Cloud Armor: Protects against DDoS attacks and web application firewall. Cloud Armor protects against DDoS and web attacks; IAP controls access based on identity; KMS handles encryption keys; DLP protects sensitive data. Distractors swap these functions.

Answer

Cloud Armor: Manages encryption keys for cloud services

Answer

Cloud Identity-Aware Proxy (IAP): Scans for vulnerabilities in compute instances

Question 12

A company runs a web application on Compute Engine behind an HTTP load balancer. They want to improve reliability by implementing failover across two regions. Which TWO actions should they take?

Accepted Answer

Deploy a global external HTTP load balancer with backends in both regions.. A global external HTTP load balancer is required for cross-region failover because it uses a single anycast IP address and routes traffic to the closest healthy backend. By deploying backends in both regions, the load balancer automatically fails over to the secondary region if the primary region's backends become unhealthy, improving reliability without DNS propagation delays.

Answer

Configure DNS-based failover using Cloud DNS with health checks.

Answer

Use an internal load balancer to route traffic between regions.

Answer

Use a regional external HTTP load balancer with a multi-region backend.

Question 13

A financial services company must comply with PCI DSS. They use Cloud SQL for MySQL for transaction processing. They need to ensure that all data at rest is encrypted with keys generated and stored in a Hardware Security Module (HSM) and that key rotation occurs every 90 days. Which configuration should they use?

Accepted Answer

Use Cloud SQL with CMEK backed by Cloud HSM, and set automatic rotation period of 90 days. Cloud SQL with CMEK backed by Cloud HSM meets the requirement for keys generated and stored in an HSM, and Cloud HSM supports automatic key rotation with a configurable period, including 90 days. CMEK allows you to manage and rotate the key used to encrypt data at rest, while Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key storage. The automatic rotation period can be set to 90 days via the key rotation policy in Cloud KMS, satisfying the compliance mandate.

Answer

Use Cloud External Key Manager (EKM) to integrate with on-premises HSM

Answer

Use Cloud SQL with customer-supplied encryption keys (CSEK) and automate rotation with Cloud Scheduler

Answer

Use Cloud SQL's default encryption with organization policy requiring rotation

Question 14

A company is using Cloud Spanner to serve a global gaming application. They have a single instance in us-central1. Players in Asia experience high latency. The application reads and writes player profiles. The team wants to reduce latency for Asian players while keeping write latency low for global consistency. They need a solution that minimizes operational overhead and uses native Spanner capabilities. What should they do?

Accepted Answer

Configure a multi-region instance configuration that includes us-central1 and an Asian region.. A multi-region instance configuration in Cloud Spanner is the correct solution because it provides a single writable instance that spans multiple geographic regions, allowing reads and writes to be served locally in each region while maintaining strong global consistency. This minimizes latency for Asian players by enabling local reads and writes, and it uses native Spanner capabilities without additional operational overhead. Option A directly addresses the requirement for low write latency and global consistency by leveraging Spanner's built-in multi-region replication.

Answer

Add read replicas in Asia using Spanner's read-only replicas.

Answer

Use Cloud CDN to cache player profiles at the edge.

Answer

Create a new instance in asia-east1 and use Directed Read options to route reads from Asia.

Question 15

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) with autoscaling. During a traffic spike, some instances become unhealthy but are not automatically replaced. What is the most likely cause?

Accepted Answer

The autohealing health check is misconfigured.. The most likely cause is that the autohealing health check is misconfigured. In a managed instance group, autohealing relies on a health check to detect unhealthy instances and trigger replacement. If the health check is misconfigured (e.g., wrong port, path, or protocol), the MIG will not recognize instances as unhealthy and will not automatically replace them, even during a traffic spike.

Answer

The MIG is regional and one zone failed.

Answer

The instance template has a startup script error.

Answer

The HTTP load balancer's health check is failing.

Question 16

A startup deploys a microservices application on GKE. They need to ensure high availability of the services. Which two strategies should they implement? (Choose TWO.)

Accepted Answer

Use regional persistent disks for stateful components. Regional persistent disks provide synchronous replication across two zones within a region, ensuring that stateful workloads (e.g., databases) remain available even if an entire zone fails. This is critical for high availability of stateful components in a GKE cluster, as it prevents data loss and allows pods to be rescheduled in another zone with the same persistent volume.

Answer

Use horizontal pod autoscaling

Answer

Use node auto-repair

Answer

Use cluster autoscaler

Question 17

A company uses Cloud Build to automate their CI/CD pipeline. They want to optimize the build process for a Java application. Which three practices should they adopt? (Choose three.)

Accepted Answer

Parallelize independent build steps by using Cloud Build's step parallelism or by splitting into multiple builds.. Cloud Build allows you to define build steps that run sequentially by default, but you can parallelize independent steps by using the `waitFor` field to specify dependencies. This reduces total build time by running non-dependent steps concurrently, which is a key optimization for CI/CD pipelines. Splitting into multiple builds is also a valid approach for parallel execution.

Answer

Use a custom build step that downloads all tools from the internet each time.

Answer

Use a high-CPU machine type (e.g., n1-highcpu-64) for faster compilation.

Question 18

An application uses Cloud Pub/Sub for asynchronous processing. Subscribers occasionally fail to acknowledge messages within the ack deadline, causing redelivery. How to improve reliability and prevent message buildup?

Accepted Answer

Implement exponential backoff in the subscriber retry logic. Implementing exponential backoff in the subscriber retry logic allows the subscriber to gradually increase the delay between retries when messages are not acknowledged, reducing the likelihood of overwhelming the system and preventing message buildup. This approach aligns with Cloud Pub/Sub's recommended practices for handling transient failures, as it gives the subscriber time to recover without exhausting the ack deadline or causing excessive redelivery.

Answer

Increase the ack deadline to the maximum value

Answer

Set max delivery attempts to 1 to avoid redelivery

Answer

Use a dead-letter topic to capture failed messages

Question 19

Your organization uses Cloud Logging to collect logs from all GCP projects. The security team wants to be alerted when a specific IAM policy change (e.g., granting roles/compute.admin to a user) occurs in any project. They need near real-time notification via email and a ticketing system. What should you do?

Accepted Answer

Create a log-based alert in Cloud Logging with a filter for SetIamPolicy and configure a Pub/Sub notification channel. Use a Cloud Function subscribed to that topic to create a ticket in the ticketing system.. Log-based alerts in Cloud Logging can monitor logs for a specific filter (e.g., protoPayload.methodName=SetIamPolicy) and send notifications to multiple channels (email, Pub/Sub). Pub/Sub can then trigger a Cloud Function to create a ticket. Alerting policies can also use log-based metrics. Cloud Audit Logs logs IAM changes. The correct approach is to create a log-based alert with a Pub/Sub notification channel.

Answer

Use Cloud Asset Inventory to monitor IAM policy changes and set up a notification to Pub/Sub.

Answer

Export all logs to BigQuery and run a scheduled query every hour to detect changes. If found, send an email using Cloud Scheduler.

Answer

Create a Cloud Monitoring alert policy based on a metric from the Cloud Audit Logs, with email and SMS notifications.

Question 20

Which THREE options are valid strategies for disaster recovery (DR) in Google Cloud?

Accepted Answer

Deploy a mirrored environment in another region and use Traffic Director to fail over.. Traffic Director, based on the xDS API (Envoy), can manage traffic routing across regions. By deploying a mirrored environment in another region and configuring Traffic Director with failover policies, you can redirect traffic to the secondary region if the primary fails, enabling a robust active-passive or active-active DR strategy.

Answer

Store hourly snapshots of Compute Engine disks in the same region.

Answer

Enable Cloud CDN to cache static content from multiple origins.