Google PCA Practice Exam 62 — 20 Questions

Question 1

A security team wants to receive alerts when a user attempts to grant the 'roles/owner' role to a member outside of the organization's domain. Which log filter should they use to create a log-based metric?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Filter on Admin Activity log type with 'protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND NOT protoPayload.request.policy.bindings: member: "example.com"'.. It uses the Admin Activity audit log type, which captures IAM policy changes, and filters for the SetIamPolicy method on the cloudresourcemanager service. The condition NOT protoPayload.request.policy.bindings: member: "example.com" ensures alerts are triggered only when the owner role is granted to a member outside the organization's domain, matching the security requirement exactly.

Answer

Filter on Data Access log type with 'protoPayload.methodName="google.iam.v1.IAMPolicy.SetIamPolicy"'.

Answer

Filter on Admin Activity logs for 'resource.type="gce_instance" AND protoPayload.methodName="compute.instances.setServiceAccount"'.

Answer

Filter on System Event logs with a query for 'resource.type="project" AND protoPayload.response.status.code=7'.

Question 2

A company runs a batch processing workload on Compute Engine that executes nightly. The job is fault-tolerant and can withstand interruptions. The job uses 500 vCPUs and runs for 4 hours each night. Which compute option is MOST cost-effective?

Accepted Answer

Preemptible VMs. Preemptible VMs are up to 80% cheaper than regular VMs and are ideal for fault-tolerant, interruptible workloads. Committed use discounts require a 1- or 3-year commitment and are not cost-effective if the job runs only a few hours nightly. On-demand instances are the most expensive. Spot VMs are similar to preemptible but with dynamic pricing; preemptible is simpler and offers fixed discount.

Answer

On-demand Compute Engine VMs

Answer

Spot VMs

Answer

Committed use discounts (1-year)

Question 3

A global e-commerce platform uses Spanner for its transactional database. They observe that some transactions are aborted with 'ABORTED' status due to contention. The application retries immediately, but throughput degrades. What design change should they implement to reduce contention?

Accepted Answer

Redesign the schema to use a separate table for frequently updated rows and batch updates using a single transaction. Spanner contention arises when multiple transactions try to update the same row concurrently, causing aborts. By redesigning the schema to use a separate table for frequently updated rows and batching updates into a single transaction, you reduce the number of overlapping locks on hot rows. This minimizes lock conflicts and aborts, improving throughput without changing Spanner's underlying TrueTime-based concurrency control.

Answer

Increase the number of nodes in the Spanner instance

Answer

Use client-side retry with exponential backoff and jitter

Answer

Change the transaction isolation level to READ UNCOMMITTED

Question 4

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) with autoscaling. Users report intermittent 503 errors during traffic spikes. Which action should the company take to improve reliability?

Accepted Answer

Configure a health check with a sufficient initial delay (grace period) in the MIG. Intermittent 503 errors during traffic spikes often indicate that new VM instances are being started but are not yet ready to serve traffic, causing the load balancer to forward requests to them prematurely. Configuring a health check with a sufficient initial delay (grace period) in the MIG ensures that newly created instances are given time to fully initialize and pass health checks before they receive traffic, preventing 503 errors. This directly addresses the root cause by allowing the application to become healthy before being added to the load balancer's backend.

Answer

Change the load balancer from regional to global

Answer

Increase the autoscaling cool-down period from 60s to 120s

Answer

Increase the maximum number of instances in the MIG

Question 5

A company is migrating sensitive customer data to Google Cloud. They need to ensure data is encrypted at rest and in transit. Which Google Cloud service provides a centralized way to manage encryption keys used by Google Cloud services?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct choice because it provides a centralized, managed service for creating, rotating, and destroying encryption keys used by Google Cloud services. It integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest, and it supports customer-managed encryption keys (CMEK) for granular control. For data in transit, Cloud KMS can be used to manage keys for TLS or application-level encryption, though Google Cloud automatically encrypts all network traffic by default.

Answer

Cloud HSM

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Secret Manager

Question 6

An organization policy at the organization level restricts project creation to only Project Creator role holders. The exhibit shows the IAM policy for the organization. A member of the group pm-team@example.com attempts to create a project but receives a permission denied error. What is the most likely cause?

Accepted Answer

An organization policy with a constraint to block project creation for non-allowlisted users is enforced.. The organization policy explicitly restricts project creation to only users who hold the Project Creator role. The user is a member of pm-team@example.com but does not have the Project Creator role, so the policy denies the request. This is a common IAM constraint at the organization level that overrides any lower-level permissions.

Answer

The user's email domain is not allowed by the organization policy.

Answer

The group pm-team@example.com does not exist.

Answer

The IAM policy is missing the resourcemanager.projectCreator role.

Question 7

A team uses Cloud Functions triggered by Cloud Storage events to process uploaded images. They want to ensure that only HTTP-triggered functions can be invoked from outside the project. Which configuration should they apply?

Accepted Answer

Set --ingress-settings=internal-only on the HTTP function. For Cloud Functions (1st gen), setting --ingress-settings=internal-only restricts invocation to within the project. For Cloud Functions (2nd gen), using an ingress setting of 'all' allows external invocation; using 'internal-only' blocks external calls.

Answer

Add a VPC firewall rule to allow only internal traffic

Answer

Remove the Cloud Storage trigger function's trigger

Answer

Set --ingress-settings=all on the HTTP function

Question 8

A company runs a web application on App Engine Standard environment. The application experiences downtime during deployments due to traffic shifting. Which two strategies should they implement to improve reliability? (Choose two.)

Accepted Answer

Use traffic splitting to gradually migrate traffic to the new version.. App Engine's traffic splitting feature allows you to gradually shift traffic from the old version to the new version, minimizing the impact of deployment-related errors or performance issues. This incremental migration reduces the risk of a full outage during deployment and enables quick rollback if problems arise.

Answer

Use Cloud Endpoints to manage API traffic and route deployments.

Answer

Increase the number of idle instances to handle traffic during deployment.

Answer

Set manual scaling to avoid autoscaling delays.

Question 9

A company wants to store backup data that is accessed rarely but must be available for retrieval within minutes. Which Cloud Storage class is appropriate?

Accepted Answer

Nearline. Nearline storage is designed for data accessed less than once a month but requires retrieval within minutes, making it ideal for backup data that needs quick availability. It offers lower cost than Standard storage while still supporting sub-minute retrieval times, aligning with the scenario's access and latency requirements.

Answer

Standard

Answer

Coldline

Answer

Archive

Question 10

Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.

Accepted Answer

Step 1: Identify the backup, Step 2: Create a new Cloud SQL instance, Step 3: Restore the backup to the new instance, Step 4: Redirect applications to the new instance.. Restoring to an existing instance may overwrite data; best practice is to restore to a new instance.

Answer

Step 1: Identify the backup, Step 2: Restore the backup to the existing instance, Step 3: Verify the data, Step 4: Redirect applications if needed.

Answer

Step 1: Create a new Cloud SQL instance, Step 2: Identify the backup, Step 3: Restore the backup to the new instance, Step 4: Redirect applications.

Answer

Step 1: Identify the backup, Step 2: Redirect applications to a new instance, Step 3: Restore the backup to the new instance, Step 4: Verify the restoration.

Question 11

A startup is building a real-time multiplayer game with global players. They need a database that provides strong consistency across regions and can handle millions of concurrent users. They anticipate rapid growth and want to avoid downtime for scaling. Which database service meets these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is a globally distributed, strongly consistent relational database with automatic horizontal scaling. It provides strong consistency across regions and can handle millions of transactions per second. Firestore is eventually consistent (or strong within a region) and not designed for relational data. Bigtable does not support strong consistency across regions. Cloud SQL is regional with limited scalability.

Answer

Cloud SQL with cross-region replication

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 12

A company is designing a multi-region architecture for disaster recovery. Their primary region is us-central1 and they want a warm standby in another region. The application runs on Compute Engine with a stateful backend. Which approach minimizes RTO while keeping costs reasonable?

Accepted Answer

Use a managed instance group in the secondary region with persistent disk snapshots and Cloud Load Balancing failover. Minimizes RTO by pre-provisioning Compute Engine instances in the secondary region via a managed instance group, using persistent disk snapshots for stateful data. This warm standby approach keeps instances ready to serve traffic with minimal startup delay, while Cloud Load Balancing failover automatically redirects traffic on primary region failure, balancing cost and recovery speed.

Answer

Use Cloud SQL cross-region replication and start Compute Engine instances on failover

Answer

Replicate the application to Cloud Run in the secondary region

Answer

Set up a managed instance group with instance templates in the secondary region without pre-provisioned instances

Question 13

A company uses Cloud KMS to encrypt sensitive data. They need to ensure that encryption key usage is audited and that keys are rotated automatically every 30 days. Which two actions should they take? (Choose two.)

Accepted Answer

Enable Data Access audit logs for the Cloud KMS API. Enabling Data Access audit logs for the Cloud KMS API captures detailed information about every encryption key usage, including who accessed the key, when, and what operation was performed. This meets the auditing requirement by recording all key usage events in Cloud Audit Logs, which can be reviewed for compliance and security analysis.

Answer

Create a Cloud Trigger to manually rotate the key every month

Answer

Enable Cloud Key Management Service's key usage monitoring

Answer

Use Cloud External Key Manager to rotate keys externally

Question 14

A company runs a large-scale data processing pipeline using Dataflow with streaming data from Pub/Sub. They notice increasing costs due to high data shuffle operations. They want to optimize the pipeline performance and cost. Which approach should they take?

Accepted Answer

Optimize the pipeline by partitioning data and using Combine transforms.. Optimizing pipeline logic to minimize shuffle reduces resource usage and cost. Increasing workers or using larger machine types may improve performance but increase cost. Switching to batch mode would lose real-time processing capability.

Answer

Use a larger machine type for workers.

Answer

Increase the number of workers to reduce shuffle.

Answer

Switch to batch mode overnight.

Question 15

A company runs batch analytics workloads each night on Compute Engine VMs. The workloads are fault-tolerant and can be interrupted. The finance team wants to reduce compute costs. Which Compute Engine pricing model should they use?

Accepted Answer

Preemptible VMs. Preemptible VMs offer the deepest discount (up to 91% off regular pricing) and are perfect for batch, fault-tolerant workloads that can be interrupted. Committed use discounts are for long-term, steady-state usage; sustained use discounts are automatic but smaller; and sole-tenant nodes are for isolation, not cost savings.

Answer

Committed use discounts (1-year or 3-year)

Answer

Sustained use discounts

Answer

Sole-tenant nodes

Question 16

Which TWO practices improve the security of a Cloud Run service?

Accepted Answer

Enable Cloud Armor for the service.. A is correct because Cloud Armor provides web application firewall (WAF) capabilities that protect Cloud Run services from common web attacks like SQL injection and cross-site scripting (XSS). B is correct because Identity-Aware Proxy (IAP) verifies user identity and context before allowing access, enforcing authentication at the Google Cloud edge before requests reach the Cloud Run service.

Answer

Run the service in a VPC with firewall rules.

Answer

Use a canary deployment strategy.

Answer

Require client-side TLS certificates.

Question 17

A company is migrating a legacy e-commerce platform to GKE. The application consists of several stateless microservices and a stateful database. They want to minimize operational overhead for the database while ensuring high availability across zones. Which database option should they choose?

Accepted Answer

Cloud SQL for MySQL with regional high availability. Cloud SQL for MySQL with regional high availability provides a managed MySQL instance with synchronous replication across zones, automatic failover, and minimal operational overhead. Self-managing MySQL on GKE adds complexity. Cloud Spanner is globally distributed and expensive for this workload. Firestore is NoSQL, not suitable for a relational e-commerce database.

Answer

Deploy MySQL on GKE StatefulSet with persistent volumes

Answer

Cloud Firestore

Answer

Cloud Spanner

Question 18

An organization wants to monitor network traffic between VMs in a VPC for troubleshooting. Which TWO services can provide this?

Accepted Answer

Packet Mirroring (Network Intelligence Center). Packet Mirroring (Network Intelligence Center) clones actual packet contents (headers and payload) from VM instances for deep packet inspection, enabling detailed troubleshooting. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet count) flowing to and from VMs, providing visibility into network traffic patterns and bottlenecks. Both services are useful for monitoring network traffic between VMs in a VPC, with Packet Mirroring offering full packet capture and VPC Flow Logs providing metadata-level logging.

Answer

Cloud Audit Logs

Answer

Cloud Monitoring

Answer

Cloud Logging

Question 19

Your company uses Cloud VPN (HA VPN) to connect to Google Cloud. You need to achieve a 99.99% SLA for the VPN connection. What configuration is required?

Accepted Answer

Two VPN gateways, each with two tunnels, totaling four tunnels. HA VPN provides a 99.99% SLA when configured with two VPN gateways (each with two tunnels) for a total of four tunnels, and the tunnels are configured to use two different edge availability domains in Google Cloud and two different interfaces on the on-premises VPN device.

Answer

One VPN gateway with four tunnels to different on-premises devices

Answer

Two VPN gateways, each with one tunnel, using two different edge availability domains

Answer

One VPN gateway with two tunnels to the same on-premises device

Question 20

A company is planning a migration from on-premises to Google Cloud. They want to ensure minimal downtime and the ability to roll back quickly if issues arise. Which deployment strategy should they use?

Accepted Answer

Phased migration. Phased migration involves moving workloads in stages, allowing testing and rollback at each phase. This minimizes risk and downtime. Blue/green and canary are more suited for application updates, not infrastructure migration. A big bang migration is high risk.

Answer

Blue/green deployment

Answer

Big bang migration

Answer

Canary deployment