Google PCA Practice Test 7 — 10 Questions

Question 1

An organization has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They launched a Compute Engine instance in subnet-a with an internal IP 10.0.1.2 and a public IP. They want the instance to only allow HTTPS traffic from the internet. Which firewall rule should they create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ingress rule: allow tcp:443, source 0.0.0.0/0, target tag 'https-server'. The instance needs to accept incoming HTTPS traffic (TCP port 443) from the internet. An ingress firewall rule with source 0.0.0.0/0 allows traffic from any external IP, and applying it to instances with the target tag 'https-server' ensures only tagged instances are affected. This matches the requirement to allow only HTTPS from the internet.

Answer

Ingress rule: allow tcp:0-65535, source 0.0.0.0/0, target tag 'https-server'

Answer

Egress rule: allow tcp:443, destination 0.0.0.0/0, target tag 'https-server'

Answer

Ingress rule: allow tcp:443, source 10.0.0.0/16, target tag 'https-server'

Question 2

An organization uses Active Directory (AD) on-premises and wants to synchronize user identities to Google Cloud Identity so that users can access G Suite and GCP resources with their existing credentials. Which service should they use?

Accepted Answer

Cloud Directory Sync. Google Cloud Directory Sync (GCDS) is the tool designed to synchronize users, groups, and organizational units from on-premises Active Directory (or LDAP) to Google Cloud Identity or Google Workspace. It runs on-premises, reads from AD via LDAP, and provisions matching identities in Google, enabling users to sign in with existing credentials.

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Federation with Google Identity Platform

Answer

SAML SSO

Question 3

An engineer needs to view the logs of a specific Compute Engine instance in near real-time from the command line. Which gcloud command should they use?

Question 4

Your company's global e-commerce platform uses a managed instance group (MIG) in us-central1 and a Cloud Load Balancer. Traffic has grown, and you want to improve availability by distributing load across multiple regions. What should you do?

Accepted Answer

Create MIGs in additional regions and add them as backends to the existing global load balancer.. A global external HTTP(S) load balancer can have backends in multiple regions. By creating managed instance groups (MIGs) in additional regions and adding them as backends to the existing global load balancer, you distribute traffic across regions, improving availability and reducing latency for users worldwide. This approach leverages the load balancer's anycast IP and cross-region load balancing capabilities.

Answer

Increase the machine type of the existing instances to handle more traffic.

Answer

Enable Cloud CDN to cache content closer to users.

Answer

Change the load balancer to global and configure a single backend.

Question 5

A healthcare organization stores Protected Health Information (PHI) in Cloud SQL. They have implemented encryption at rest using CMEK and enforce TLS for all connections. To meet HIPAA compliance, they need to ensure that PHI cannot be exfiltrated from the Cloud SQL instance even if an application is compromised. The Cloud SQL instance is accessed by Compute Engine instances in the same VPC using private IPs. The security team wants to add an additional layer of defense against data exfiltration. What should they do?

Accepted Answer

Configure VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect.. VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect prevents data exfiltration by creating a security boundary around the Cloud SQL instance. Even if an application is compromised, the service perimeter blocks unauthorized copying or movement of PHI outside the perimeter, and Private Service Connect ensures traffic stays within Google's network without traversing the public internet. This directly addresses the requirement for an additional layer of defense against exfiltration beyond encryption and TLS.

Answer

Deploy Cloud Armor and apply a WAF rule to block suspicious traffic to the Cloud SQL instance.

Answer

Use the Cloud SQL Auth proxy from all applications to enforce IAM-based authentication.

Answer

Enable customer-managed encryption keys (CMEK) on the Cloud SQL instance.

Question 6

Refer to the exhibit. A user (ops@example.com) is unable to create a new VPC network in the project. What should the administrator verify first?

Accepted Answer

The user has appropriate IAM roles such as roles/compute.networkAdmin.. To create a VPC network in Google Cloud, the user needs the compute.networks.create permission. The roles/compute.networkAdmin IAM role includes this permission, along with others needed to manage VPC networks. Option D correctly identifies that the user must have appropriate IAM roles, specifically roles/compute.networkAdmin or a custom role with the necessary compute.networks.create permission.

Answer

The user has been granted roles/compute.admin.

Answer

The user has the project owner role.

Answer

The user has the roles/storage.admin role.

Question 7

A company needs to store archival data that is accessed less than once a year. They want the lowest storage cost possible, but they can accept a retrieval time of up to 24 hours. Which Cloud Storage class should they use?

Accepted Answer

Archive. Archive storage is the lowest-cost storage class for long-term archival with retrieval times in hours (typically 24 hours). Coldline is for data accessed less than once a quarter. Nearline is for monthly access. Standard is for frequently accessed data.

Answer

Nearline

Answer

Standard

Answer

Coldline

Question 8

Refer to the exhibit. A Cloud Deploy pipeline has a release with two targets: staging and prod. The staging rollout succeeded, but the prod rollout failed with 'MANIFEST_INVALID'. What is the most likely cause of the failure?

Accepted Answer

The manifest for prod contains a syntax error or references a resource that does not exist in the prod cluster.. The 'MANIFEST_INVALID' error in Cloud Deploy indicates that the Kubernetes manifest provided for the prod target is syntactically incorrect or references a resource (e.g., a ConfigMap, Secret, or custom resource definition) that does not exist in the prod cluster. This is a validation failure that occurs before any deployment attempt, so it is not related to runtime issues like permissions or quotas.

Answer

The prod target's applyManifest has a higher replica count than staging, which violates a cluster quota.

Answer

The prod cluster does not have the necessary permissions to pull the container image.

Answer

The release was not approved for the prod target.

Question 9

A company uses Cloud Deploy for continuous delivery. They have a delivery pipeline with multiple targets: dev, staging, and prod. They want to require manual approval before deploying to prod. How should they configure this?

Accepted Answer

Configure an approval gate on the prod target in the delivery pipeline. Google Cloud Deploy supports approval gates on targets, which pause a rollout and require manual approval before proceeding to the next target. Configuring an approval gate on the prod target in the delivery pipeline enforces the manual approval requirement natively.

Answer

Add a Cloud Build trigger that pauses and waits for approval

Answer

Use IAM conditions to restrict deployment to prod

Answer

Set up a Pub/Sub notification and a Cloud Function to approve

Question 10

A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?

Accepted Answer

Use Cloud Armor security policies with geographic-based denylist rules.. Cloud Armor security policies support geographic-based access control using denylist or allowlist rules that match client IP addresses against country-level geolocation data. This allows the security team to block traffic from specific countries at the edge, before it reaches the backend, which is the most efficient and compliant approach for GDPR enforcement.

Answer

Configure Cloud CDN to serve content only to EU-based users.

Answer

Set VPC firewall rules to allow traffic only from EU IP ranges.

Answer

Configure Identity-Aware Proxy (IAP) to require user authentication from allowed countries.