Google PCA Analyze and optimize technical and business processes Practice Test 2 — 15 Questions

Question 1

A financial institution stores sensitive customer data in Cloud Storage. They need to audit all data access and prevent unauthorized data exfiltration. They also require context-aware access controls based on user location and device. Which Google Cloud service should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Service Controls with the perimeter set to the data layer. VPC Service Controls (option C) is correct because it creates a security perimeter around Google Cloud APIs, including Cloud Storage, to prevent unauthorized data exfiltration (e.g., copying data to an external project) while allowing context-aware access controls based on user location and device via Access Context Manager. This directly addresses the requirement for both audit (via Cloud Audit Logs integrated with the perimeter) and exfiltration prevention, which other services like DLP or Access Transparency alone cannot enforce.

Answer

Cloud Data Loss Prevention (DLP) for inspecting data

Answer

Cloud Audit Logs and Cloud Monitoring for alerts

Answer

Access Transparency logs for audit

Question 2

A company uses Cloud CDN to accelerate content delivery for their global user base. They notice a low cache hit ratio, and they also need to deliver personalized content based on user geolocation. What should they do?

Accepted Answer

Set appropriate Cache-Control headers and use cache keys including the 'User-Geo' header. Setting appropriate Cache-Control headers (e.g., s-maxage, private vs. public) allows Cloud CDN to cache content effectively, while including the 'User-Geo' header in cache keys enables the CDN to serve different cached responses based on the user's geolocation. This approach balances caching efficiency with personalized content delivery, as the CDN can cache a separate copy for each geographic region without requiring a cache miss for every request.

Answer

Configure cache keys based on URL and query parameters

Answer

Use signed URLs for personalized content

Answer

Serve personalized content from the origin and use Cloud CDN only for static content

Question 3

A data analytics team uses BigQuery to run large queries. They want to reduce query costs. Which three practices should they adopt? (Choose THREE.)

Accepted Answer

Use clustered tables on commonly filtered columns. Option B is correct because clustering BigQuery tables on commonly filtered columns physically sorts data by those columns, so queries that filter on them scan far fewer bytes and thus cost less. Option C is correct because partitioning tables by date lets BigQuery prune irrelevant partitions, so a query with a date filter only scans the matching partitions instead of the whole table. Option D is correct because materialized views precompute and store frequent aggregation results, so repeated aggregate queries read the smaller precomputed result rather than rescanning the full base tables. Option A is not among the marked correct answers here, and Option E is wrong because SELECT * forces BigQuery to read every column, maximizing bytes scanned and cost rather than reducing it.

Answer

Use query caching

Answer

Always use SELECT * to ensure all columns are available

Question 4

A startup deploys a microservices application on GKE. They need to ensure high availability of the services. Which two strategies should they implement? (Choose TWO.)

Accepted Answer

Use regional persistent disks for stateful components. Option B is correct because regional persistent disks synchronously replicate data across two zones within a region, so stateful components survive a single-zone failure and remain available when a pod is rescheduled to another zone. Option D is correct because spreading the application across multiple zones in a region ensures that a zone outage does not take down all replicas, which is the core of GKE high availability for stateless and stateful workloads. Option A (horizontal pod autoscaling) only adjusts replica counts based on load and does not protect against zone-level failures. Option C (node auto-repair) merely repairs unhealthy nodes and does not provide cross-zone redundancy. Option E (cluster autoscaler) only adds or removes nodes based on resource demand and likewise does not guarantee availability during a zone outage.

Answer

Use horizontal pod autoscaling

Answer

Use node auto-repair

Answer

Use cluster autoscaler

Question 5

Refer to the exhibit. A Cloud Run service is experiencing high latency and returns 502 errors when traffic spikes. What should the team adjust first?

Accepted Answer

Decrease containerConcurrency to 10. The 502 errors and high latency during traffic spikes indicate that the Cloud Run service is overwhelmed by concurrent requests. Decreasing `containerConcurrency` to 10 limits the number of simultaneous requests each container instance can handle, which reduces the likelihood of request timeouts and 502 errors by forcing Cloud Run to scale out more instances sooner. This directly addresses the root cause—excessive concurrency per container—without incurring additional cost or requiring code changes.

Answer

Increase the maximum number of instances

Answer

Increase the CPU limit to 2000m

Answer

Increase the memory limit to 512Mi

Question 6

Refer to the exhibit. A Cloud Function processes files uploaded to Cloud Storage. It usually completes within 2 minutes, but recently it has been timing out after 540 seconds. What is the most likely cause?

Accepted Answer

A user uploaded a file larger than the maximum allowed size for the function (e.g., 6 GB), causing the processing time to exceed the 540s timeout. Cloud Functions have a maximum execution timeout of 540 seconds (9 minutes). If a file larger than the function's memory and processing capacity is uploaded, the function may take longer than this hard limit to process it, resulting in a timeout. The exhibit indicates the function usually completes within 2 minutes, so a sudden spike to exactly 540 seconds strongly suggests the file size exceeded the function's ability to finish within the maximum allowed timeout.

Answer

The function's maximum timeout was set to 540 seconds, causing it to always take that long

Answer

The function's memory limit is too low, causing thrashing and slowdown

Answer

The function entered an infinite loop

Question 7

Refer to the exhibit. A team wants to grant the ability to run queries (but not modify) on BigQuery datasets to a new set of users who have email addresses in the 'example.com' domain. What is the simplest way to achieve this?

Accepted Answer

No action needed; new users with 'example.com' accounts already have the dataViewer role through the existing domain membership. The exhibit shows an existing IAM policy binding that grants the 'roles/bigquery.dataViewer' role to 'domain:example.com'. IAM domain-based bindings automatically apply to all authenticated users with email addresses in that domain. When new users with 'example.com' accounts are added, they inherit this role without any additional configuration, as IAM evaluates domain membership at access time.

Answer

Create a new binding with role 'roles/bigquery.dataViewer' and include the new users as members

Answer

Remove the domain binding and only grant access to individual users

Answer

Add the new users to the existing 'domain:example.com' member list

Question 8

A company wants to reduce Google Cloud costs for a batch processing workload. They currently use n1-standard-4 VMs running 24/7. The workload runs for 2 hours each night. What is the most cost-effective recommendation?

Accepted Answer

Use preemptible VMs with a startup script and persistent disk.. D is correct because the workload runs for only 2 hours per night, making preemptible VMs ideal — they cost up to 80% less than on-demand VMs and can be terminated at any time. A startup script ensures the job resumes if the VM is preempted, and using a persistent disk preserves data across interruptions. This combination provides the lowest cost for a short, fault-tolerant batch job.

Answer

Use on-demand VMs and rely on sustained use discounts.

Answer

Use a custom machine type with fewer vCPUs.

Answer

Use committed use discounts for 1 year.

Question 9

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to optimize costs without sacrificing availability. They have varying traffic patterns. Which strategy should they recommend?

Accepted Answer

Use node auto-provisioning with preemptible nodes.. Node auto-provisioning with preemptible nodes allows the cluster to automatically scale and use low-cost, short-lived instances for fault-tolerant workloads. Preemptible nodes are up to 60-91% cheaper than regular instances, and node auto-provisioning ensures that only the required node types are created, optimizing cost without sacrificing availability for stateless microservices that can handle interruptions.

Answer

Use committed use discounts with a 3-year term on all nodes.

Answer

Use GKE Autopilot with a single node pool.

Answer

Use a regional cluster with node pools of different machine types.

Question 10

A company wants to optimize their network costs for inter-region traffic using Cloud VPN. What is the most cost-effective configuration?

Accepted Answer

Use a single VPN tunnel with dynamic routing.. A single VPN tunnel with dynamic routing (BGP) is the most cost-effective configuration for inter-region traffic using Cloud VPN. Cloud VPN charges per tunnel-hour and per GB of data processed, so using a single tunnel minimizes the hourly cost while dynamic routing ensures automatic failover and route advertisement without needing multiple tunnels.

Answer

Use partner interconnect.

Answer

Use Cloud NAT.

Answer

Use dedicated interconnect.

Question 11

A company is using Cloud CDN to accelerate content delivery. They notice increased costs from cache misses. What can they do?

Accepted Answer

Pre-cache popular content.. Pre-caching popular content ensures that the most frequently requested objects are already stored in Cloud CDN edge caches before users request them. This directly reduces cache misses because the content is proactively loaded, eliminating the need for the first user to trigger a fetch from the origin. By targeting high-demand assets, you minimize origin requests and lower the cost associated with cache misses.

Answer

Use a larger cache size.

Answer

Increase cache TTL.

Answer

Use compression.

Question 12

Which TWO actions can reduce costs for a Cloud SQL for MySQL instance? (Choose two.)

Accepted Answer

Use committed use discounts.. Option B is correct because committed use discounts (CUDs) let you commit to a specific amount of Cloud SQL vCPU/memory usage for a 1- or 3-year term in exchange for a significant discount (up to ~52%) versus on-demand pricing, directly lowering the instance's cost. Option D is correct because Cloud SQL lets you change the machine type (tier) of an instance, so scaling down to a smaller tier during predictable off-peak hours reduces the vCPU/memory you pay for; you can scale back up when demand returns. Option A is not a cost-reduction action: database flags such as max_connections only cap concurrent connections and do not change the billing rate of the instance. Option C is not applicable: preemptible (Spot) VMs are a Compute Engine feature and cannot be used for Cloud SQL instances, which are managed services. Option E is incorrect because enabling high availability creates a standby instance in a second zone, roughly doubling the cost rather than reducing it.

Answer

Use database flags to limit connections.

Answer

Use preemptible instances.

Answer

Use high availability configuration.

Question 13

Which TWO strategies should a company implement to optimize costs for a production GKE cluster? (Choose two.)

Accepted Answer

Enable GKE usage metering.. Option C (Enable GKE usage metering) is correct because it exports per-namespace and per-label resource consumption to BigQuery, giving the visibility needed to identify idle or over-provisioned workloads and attribute costs to teams, which is a prerequisite for any cost-optimization program. Option D (Use cluster autoscaler with preemptible node pools) is correct because the cluster autoscaler scales node pools down when pods no longer need capacity, and preemptible (Spot) VMs cost substantially less than on-demand instances, directly reducing compute spend for interruption-tolerant production workloads. Option A (Istio) is a service-mesh add-on that improves traffic management and observability but adds its own resource overhead and does not by itself lower cluster cost. Option B (a regional cluster) replicates the control plane and nodes across three zones for higher availability, which increases, not decreases, cost. Option E (node local DNS cache) improves DNS lookup latency and reduces DNS traffic to kube-dns, but its cost impact is negligible and it is primarily a performance feature.

Answer

Use Istio for traffic management.

Answer

Use a regional cluster.

Answer

Use node local DNS cache.

Question 14

Refer to the exhibit. This is an IAM policy for a BigQuery dataset. What does the policy allow?

Accepted Answer

Alice to view data and analysts to run jobs.. The policy grants the `roles/bigquery.dataViewer` role to Alice, which allows her to view dataset metadata and query data, and the `roles/bigquery.jobUser` role to analysts, which allows them to run jobs (queries, load, export) but not view data directly. This combination matches option A.

Answer

Alice and analysts to run jobs.

Answer

Alice to run jobs and analysts to view data.

Answer

Alice and analysts to view data.

Question 15

Refer to the exhibit. The log entry is from Cloud Logging for a VPC subnetwork. What is the most likely cause of this error?

Accepted Answer

A firewall rule blocking ingress on port 80.. The log entry indicates a packet was dropped by a firewall rule. Since the destination is 10.0.0.2 on port 80 (HTTP), the most likely cause is a firewall rule blocking ingress traffic on port 80. In Google Cloud VPC, firewall rules are stateful and evaluated before any routing decisions, so a missing or misconfigured ingress rule for TCP port 80 would cause this drop.

Answer

The subnetwork default has no internet gateway.

Answer

The VM at 10.0.0.2 is not running.

Answer

The packet is malformed.