Google PCA Practice Test 9 — 10 Questions

Question 1

A small company wants to store sensitive files in Cloud Storage and ensure they are encrypted with a key that they control and rotate automatically every 90 days. They are currently using the default encryption provided by Google Cloud. They need a solution that is easy to manage and does not require manual key rotation. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud KMS key ring and key with CMEK, set a rotation period of 90 days, and configure the bucket to use that key.. Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow the company to control the key while leveraging automatic rotation. By creating a key ring and key with a 90-day rotation period, and configuring the Cloud Storage bucket to use that key, the company meets the requirement for automated rotation without manual intervention. This solution is easy to manage and integrates natively with Cloud Storage, avoiding the complexity of external encryption or scripting.

Answer

Use Cloud HSM to generate a key and handle encryption outside of Cloud Storage.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and write a script to rotate the key every 90 days.

Answer

Continue using default encryption as it is automatically rotated by Google.

Question 2

Refer to the exhibit. What is the primary benefit of the `--preemptible` flag in this command?

Accepted Answer

Significant cost reduction compared to standard instances.. The `--preemptible` flag in Google Cloud Platform (GCP) creates preemptible VM instances, which are short-lived, cost-effective instances that can be terminated at any time by GCP. The primary benefit is a significant cost reduction—up to 60-91% lower than standard instances—making them ideal for batch jobs, fault-tolerant workloads, and non-critical tasks. This flag does not affect startup time, availability guarantees, or provide free access to specialized hardware.

Answer

Faster instance startup time due to optimized kernel.

Answer

Higher availability through automatic restart on failure.

Answer

Access to specialized hardware like GPUs at no extra cost.

Question 3

An organization is implementing a data loss prevention (DLP) strategy for Cloud Storage. They want to automatically scan new objects uploaded to a specific bucket and redact sensitive data. Which service and configuration should they use?

Accepted Answer

Use Cloud Functions triggered by Cloud Storage events to call Cloud DLP API for each new object, and then store the redacted version.. It uses Cloud Functions as an event-driven compute service that triggers on Cloud Storage object finalize events. The function then calls the Cloud DLP API to inspect and redact sensitive data from the new object, and writes the redacted version back to the bucket. This provides automatic, near-real-time scanning and redaction for each uploaded object, aligning with the requirement for an automated DLP strategy.

Answer

Configure Cloud Armor with a WAF rule to inspect and redact data as it enters the bucket.

Answer

Enable Security Command Center (SCC) premium tier and configure it to scan the bucket for sensitive data.

Answer

Use Cloud DLP with a BigQuery external table to scan the bucket contents periodically.

Question 4

A company runs a batch processing job that uses preemptible VMs. The job occasionally fails due to VM preemption. They want to improve reliability without significantly increasing cost. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Use a managed instance group with autoscaling and preemptible VMs. Option A is correct because a managed instance group (MIG) with autoscaling and preemptible VMs automatically maintains the desired number of instances, replacing preempted VMs with new ones so the batch job can continue running with minimal disruption and without paying for non-preemptible capacity. Option D is correct because preemptible VMs can be reclaimed at any time, so building a retry mechanism into the job lets failed tasks be re-run on surviving or replacement instances, directly improving reliability at essentially no extra cost. Option B is not appropriate because sole-tenant nodes isolate hardware for compliance/licensing reasons and do not reduce the risk of preemption. Option C would improve reliability but significantly increases cost, which the scenario explicitly wants to avoid. Option E merely adds more preemptible VMs; it does not address task recovery and still leaves the job vulnerable to preemption.

Answer

Use sole-tenant nodes to reduce risk of preemption

Answer

Switch to regular (non-preemptible) VMs

Answer

Increase the number of preemptible VMs

Question 5

An organization wants to deploy a containerized microservices architecture on Google Kubernetes Engine (GKE) and minimize operational overhead. They do not need to manage the node infrastructure and are willing to accept some limitations on node configuration. Which GKE mode should they choose?

Accepted Answer

GKE Autopilot mode. GKE Autopilot mode is a fully managed Kubernetes experience where Google manages the control plane and the nodes, including provisioning, scaling, and security patching. It minimizes operational overhead because users only deploy workloads and pay for the resources their pods consume, without managing node pools. The scenario explicitly accepts limitations on node configuration, which aligns with Autopilot's opinionated, hardened node management.

Answer

GKE Standard mode with zonal cluster

Answer

Compute Engine with container-optimized OS and instance groups

Answer

Cloud Run for Anthos

Question 6

A company runs a web application on Compute Engine behind a HTTP(S) Load Balancer. They want to reduce latency for users worldwide. Which Google Cloud service should they use?

Accepted Answer

Cloud CDN. Cloud CDN caches content at Google's globally distributed edge points of presence, reducing latency by serving requests from locations closer to users. It integrates directly with HTTP(S) Load Balancer to accelerate web application delivery worldwide.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Cloud VPN

Question 7

A company runs a stateful workload on Compute Engine with regional persistent disks (PD). They need to implement a disaster recovery (DR) plan with a Recovery Point Objective (RPO) of less than 1 hour and Recovery Time Objective (RTO) of less than 4 hours. Which THREE steps should they include in their DR plan? (Choose three.)

Accepted Answer

Take snapshots of the persistent disk every 30 minutes and copy them to a Cloud Storage bucket in another region. Taking snapshots every 30 minutes meets the RPO of less than 1 hour. By copying these snapshots to a Cloud Storage bucket in another region, you ensure data is available in a DR region for recovery, which is essential for cross-region disaster recovery.

Answer

Create a snapshot schedule for the persistent disk every 4 hours

Answer

Use regional persistent disks to automatically replicate data to a second zone

Question 8

A company is using Cloud Storage for backups and wants to minimize costs. The backups are accessed infrequently and can tolerate retrieval delays. Which storage class is most appropriate?

Accepted Answer

Archive. Archive storage class is the most cost-effective option for backups that are accessed infrequently and can tolerate retrieval delays. It offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of minutes to hours, making it ideal for long-term backup data that does not require immediate access.

Answer

Standard

Answer

Coldline

Answer

Nearline

Question 9

A company wants to monitor the health of their Cloud Run services. Which THREE metrics should they use to define a comprehensive health SLI? (Choose 3)

Accepted Answer

Latency (e.g., p99 response time). Latency (p99 response time) is a critical metric for Cloud Run because it measures the end-to-end request processing time, directly reflecting user experience. In a serverless environment, high latency can indicate cold starts, insufficient concurrency, or downstream service bottlenecks, making it essential for a comprehensive health SLI.

Answer

CPU utilization

Answer

Instance count

Question 10

An organization is using Cloud Interconnect to connect their on-premises network to Google Cloud. They need to ensure 99.99% availability for their connection. Which configuration meets this requirement?

Accepted Answer

Two Dedicated Interconnect connections from different edge locations. To achieve 99.99% availability with Cloud Interconnect, Google Cloud requires two Dedicated Interconnect connections in different edge locations (or two Partner Interconnect connections in different metros). This redundant topology eliminates single points of failure at the interconnect level, meeting the SLA for 99.99% availability. A single connection, regardless of bandwidth, cannot meet this SLA.

Answer

A single Partner Interconnect connection at 1Gbps

Answer

A single Dedicated Interconnect connection at 10Gbps

Answer

High Availability VPN (HA VPN) with two gateways and four tunnels