Google PCA Practice Test 8 — 10 Questions

Question 1

A company is migrating sensitive customer data to Google Cloud. They need to ensure data is encrypted at rest and in transit. Which Google Cloud service provides a centralized way to manage encryption keys used by Google Cloud services?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct choice because it provides a centralized, managed service for creating, rotating, and destroying encryption keys used by Google Cloud services. It integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest, and it supports customer-managed encryption keys (CMEK) for granular control. For data in transit, Cloud KMS can be used to manage keys for TLS or application-level encryption, though Google Cloud automatically encrypts all network traffic by default.

Answer

Cloud HSM

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Secret Manager

Question 2

A company wants to control which resources can be accessed by a service account in a specific project. Which IAM policy binding approach should be used?

Accepted Answer

Grant the service account a role at the project or resource level. Granting the service account a role at the project or resource level follows the principle of least privilege by scoping permissions to only the resources the service account needs to access. This is the standard IAM policy binding approach in Google Cloud for controlling access within a specific project. It avoids over-privileged access and aligns with security best practices.

Answer

Use VPC Service Controls to restrict the service account

Answer

Add the service account to a Cloud Identity group and grant the group a role

Answer

Grant the service account a role at the organization level

Question 3

A company uses Cloud Storage to store sensitive customer data. They must ensure that data at rest is encrypted with a customer-managed key that is automatically rotated every 90 days. Which Cloud Storage configuration should they use?

Accepted Answer

Enable default encryption with a customer-managed key (CMEK) from Cloud KMS with automatic rotation set to 90 days. Cloud KMS customer-managed encryption keys (CMEK) can be configured as the default encryption key for a Cloud Storage bucket, and Cloud KMS supports automatic rotation schedules (e.g., every 90 days). This satisfies both requirements: customer-managed key and automatic 90-day rotation, with no manual intervention.

Answer

Use customer-supplied encryption keys (CSEK) and rotate them manually

Answer

Use Cloud HSM to create a key and set the bucket to use that key without rotation policy

Answer

Use Google-managed encryption keys (SSE-GM)

Question 4

The firewall rule 'allow-ssh' was not created. According to the audit log, what is the most likely reason?

Accepted Answer

The user does not have the compute.firewalls.create permission.. The audit log indicates the firewall rule 'allow-ssh' was not created because the user lacks the specific permission required to create firewall rules in Google Cloud. The correct permission is `compute.firewalls.create`, which is part of the `compute.securityAdmin` role but not automatically granted with it; the `compute.securityAdmin` role includes `compute.firewalls.create`, so Option B is factually incorrect. The most likely reason is that the user does not have the `compute.firewalls.create` permission, which is a prerequisite for creating firewall rules.

Answer

The user is not authenticated.

Answer

The user has the compute.securityAdmin role but not compute.firewalls.create.

Answer

The firewall rule already exists and cannot be duplicated.

Question 5

Your organization runs a production Cloud SQL for PostgreSQL instance. You need to ensure that if the primary zone fails, the database automatically fails over to a standby with no data loss. Which configuration should you use?

Accepted Answer

Deploy a regional Cloud SQL instance with high availability. A regional Cloud SQL instance with high availability provisions a standby in a different zone within the same region and performs automatic failover via a regional persistent disk, with synchronous replication ensuring zero data loss (RPO ≈ 0). This is the only option that combines automatic failover with no data loss for a single-region production database.

Answer

Enable point-in-time recovery (PITR)

Answer

Configure a cross-region replica

Answer

Create a read replica and promote it on failure

Question 6

A company needs a relational database that can scale horizontally across multiple regions, supports ACID transactions, and provides strong global consistency. Which Google Cloud database should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that offers horizontal scaling, ACID transactions, and strong global consistency across regions.

Answer

BigQuery

Answer

Cloud SQL

Answer

Firestore

Question 7

An e-commerce company is experiencing traffic spikes during flash sales. Their application runs on Compute Engine instances behind a TCP load balancer. They want to automatically scale the number of instances based on CPU utilization. Which configuration is required?

Accepted Answer

Create a managed instance group (MIG) with an autoscaling policy based on CPU utilization.. Managed Instance Groups (MIGs) with autoscaling based on CPU utilization is the correct approach. Cloud Functions and Cloud Run are not Compute Engine instance scaling. A global HTTP(S) Load Balancer is not required for TCP traffic.

Answer

Configure Cloud Run for autoscaling and rewrite the application to run in containers.

Answer

Create an unmanaged instance group with a static number of instances and configure Cloud CDN.

Answer

Use Cloud Functions to handle traffic spikes and redirect traffic from the load balancer.

Question 8

Refer to the exhibit. An application running on a GCE instance (ID: 1234567890) is unable to connect to a database at 10.0.0.1:5432. The logs show repeated 'Connection refused' errors. What is the most likely cause?

Accepted Answer

The database service is not running or is not listening on port 5432.. The 'Connection refused' error indicates that the TCP handshake was rejected by the target host, which typically means the database service is not actively listening on port 5432. This is distinct from a firewall block, which would result in a timeout or 'no route to host' error. Since the error is immediate and specific to port 5432, the most likely cause is that the PostgreSQL or other database service is not running or is bound to a different interface/port.

Answer

The firewall rule allowing traffic on port 5432 is missing or misconfigured.

Answer

The instance is using an outdated SSL certificate.

Answer

The VPC network has no route to the database subnet.

Question 9

The exhibit shows a Cloud Storage bucket configuration. What does this configuration ensure?

Accepted Answer

Objects can only be permanently deleted after the retention period expires.. The exhibit shows a bucket configured with a retention policy. When a retention policy is set on a Cloud Storage bucket, objects cannot be deleted or overwritten until the retention period expires. This ensures that objects can only be permanently deleted after the retention period ends, which is exactly what option C describes.

Answer

Older versions of objects are automatically transferred to a different storage class.

Answer

Data is replicated to another region for disaster recovery.

Answer

Objects older than 30 days will be automatically deleted.

Question 10

Match each IAM role type to its description.

Accepted Answer

Basic roles: Broad roles that apply to all resources in a project (Owner, Editor, Viewer). In GCP, IAM roles are categorized into basic (broad), predefined (service-specific), and custom (user-defined). Common confusions arise between predefined and custom roles.

Answer

Basic roles: Roles curated by Google Cloud that provide fine-grained access for specific services

Answer

Predefined roles: Roles that you create to tailor permissions to your organization's specific needs