Google PCA Analyze and optimize technical and business processes Practice Test 2 — 15 Questions

Question 1

A company is using Cloud NAT to allow instances in a private subnet to access the internet for updates. The security team wants to audit outbound connections. Which TWO steps should be taken to enable flow logs for Cloud NAT?

Accepted Answer

Configure a log sink to export Cloud NAT logs to BigQuery. Cloud NAT flow logs provide detailed records of outbound connections and are enabled directly on the Cloud NAT gateway itself. Option B is correct because configuring a log sink to export Cloud NAT logs to BigQuery is a valid step to audit outbound connections, but the primary step to enable logging is to update the existing Cloud NAT gateway to enable flow logs (Option E). Together, these two steps (B and E) allow you to capture and analyze outbound traffic for auditing.

Answer

Enable private Google access on the subnet

Answer

Enable VPC Flow Logs on the subnet

Answer

Create a new Cloud NAT gateway with logging enabled

Question 2

A team deployed the Terraform configuration shown in the exhibit. They observe that Cloud NAT is not translating traffic from the private subnet as expected. What is the most likely cause?

Accepted Answer

The Cloud Router is not in the same VPC network as the private subnet. Option A is correct because Cloud NAT requires a Cloud Router to be in the same VPC network as the subnet whose traffic needs translation. If the Cloud Router is in a different VPC network, the NAT gateway cannot establish the necessary BGP sessions or route traffic from the private subnet, causing NAT to fail silently.

Answer

The log filter is set to ERRORS_ONLY, which suppresses all logs

Answer

The NAT IP allocation is manual and no IPs were specified

Answer

The subnet is not included in the source_subnetwork_ip_ranges_to_nat list

Question 3

A startup runs a web application on Google Kubernetes Engine (GKE) with 3 replicas serving user traffic. They use Cloud SQL for the database. Recently, the application experienced intermittent timeouts during peak hours. Monitoring shows high CPU usage on the GKE nodes and increased database connection pool exhaustion. The team is looking for a cost-effective solution that minimizes architectural changes. The application is stateless. What should they do?

Accepted Answer

Increase the number of pod replicas and configure a connection pooler like PgBouncer for Cloud SQL. The application is stateless and experiencing database connection pool exhaustion alongside high CPU on GKE nodes. Increasing pod replicas distributes the CPU load across more pods, while adding a connection pooler like PgBouncer reduces the number of direct connections to Cloud SQL, preventing pool exhaustion without requiring database tier changes. This approach is cost-effective because it optimizes existing resources rather than scaling infrastructure.

Answer

Add more nodes to the GKE cluster and enable cluster autoscaling

Answer

Vertically scale the GKE node pool to larger machine types and increase Cloud SQL tier

Answer

Set up a Cloud SQL read replica and route read queries to it

Question 4

Drag and drop the steps to set up a Cloud SQL for PostgreSQL instance with high availability into the correct order.

Question 5

Drag and drop the steps to implement a disaster recovery plan using Cloud Storage and Cloud Functions in the correct order.

Question 6

Match each GCP database service to its type.

Question 7

Match each GCP migration term to its description.

Question 8

A startup deploys a web application on Compute Engine instances behind an HTTP load balancer. They need to handle unpredictable spikes in traffic with minimal operational overhead. What is the simplest scaling approach?

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization. Using a managed instance group with autoscaling automatically adds/removes instances based on demand, requiring minimal manual intervention. Other options either require more complex setup or are not optimal.

Answer

Set up a Kubernetes cluster with horizontal pod autoscaling

Answer

Migrate the application to Cloud Run

Answer

Add more instances manually during peak hours

Question 9

A company stores backup data in Cloud Storage. They observe high egress costs when clients download backups. Additionally, they must retain backups for 7 years for compliance. Which optimization should they implement first?

Accepted Answer

Enable requester pays on the bucket. High egress costs occur when clients download backups, and enabling requester pays shifts these costs to the clients. This directly addresses the cost issue without changing storage class or retention. Requester pays is the first optimization because it resolves the immediate cost problem while lifecycle rules or storage class changes address separate concerns like retention or storage cost.

Answer

Use lifecycle rules to transition to Archive after 30 days and delete after 7 years

Answer

Set up a Cloud CDN for backup downloads

Answer

Move the backup data to Archive storage class

Question 10

A company runs a streaming data pipeline using Dataflow to process real-time data and insert into BigQuery. Recently, workers are frequently failing with out-of-memory errors and the pipeline latency is increasing. What should they do to resolve the issue?

Accepted Answer

Enable Dataflow Streaming Engine. Dataflow Streaming Engine offloads the streaming data processing state and shuffle data from worker memory to a backend service, reducing memory pressure on workers. This directly addresses out-of-memory errors and latency increases without requiring manual scaling or machine type changes. It is the recommended solution for streaming pipelines experiencing memory bottlenecks.

Answer

Increase the worker machine type and memory

Answer

Use Cloud Pub/Sub for buffering and then load into BigQuery in batches

Answer

Enable autoscaling and increase the maximum number of workers

Question 11

A company uses Cloud SQL for PostgreSQL for their transactional database. They need a disaster recovery solution that provides cross-region failover with a recovery point objective (RPO) of less than 1 minute. Which solution meets these requirements?

Accepted Answer

Create a cross-region read replica and promote it during failover. A cross-region read replica in Cloud SQL for PostgreSQL can be promoted to a standalone instance during a disaster, enabling failover to another region. The replica uses PostgreSQL's native streaming replication, which typically provides an RPO of less than 1 minute because changes are replicated asynchronously but with very low latency. This meets the stated RPO requirement without needing to redesign the application for global consistency.

Answer

Use Cloud Spanner for global strong consistency

Answer

Use a Cloud SQL for PostgreSQL instance with multiple zones

Answer

Take daily automated backups and restore in another region

Question 12

A development team uses Cloud Build for their CI/CD pipeline. They want to reduce build times. Which action is most effective?

Accepted Answer

Enable parallel builds by separating build steps into multiple jobs. Enabling parallel builds by separating build steps into multiple jobs reduces total build time by running independent steps concurrently. Other options are less effective or add complexity.

Answer

Store build artifacts in a Cloud Storage bucket and reuse them

Answer

Use more powerful build machines by specifying larger machine types

Answer

Use a Cloud Run service to run builds asynchronously

Question 13

A financial institution stores sensitive customer data in Cloud Storage. They need to audit all data access and prevent unauthorized data exfiltration. They also require context-aware access controls based on user location and device. Which Google Cloud service should they configure?

Accepted Answer

VPC Service Controls with the perimeter set to the data layer. VPC Service Controls (option C) is correct because it creates a security perimeter around Google Cloud APIs, including Cloud Storage, to prevent unauthorized data exfiltration (e.g., copying data to an external project) while allowing context-aware access controls based on user location and device via Access Context Manager. This directly addresses the requirement for both audit (via Cloud Audit Logs integrated with the perimeter) and exfiltration prevention, which other services like DLP or Access Transparency alone cannot enforce.

Answer

Cloud Data Loss Prevention (DLP) for inspecting data

Answer

Cloud Audit Logs and Cloud Monitoring for alerts

Answer

Access Transparency logs for audit

Question 14

A company uses Cloud CDN to accelerate content delivery for their global user base. They notice a low cache hit ratio, and they also need to deliver personalized content based on user geolocation. What should they do?

Accepted Answer

Set appropriate Cache-Control headers and use cache keys including the 'User-Geo' header. Option A is correct because setting appropriate Cache-Control headers (e.g., s-maxage, private vs. public) allows Cloud CDN to cache content effectively, while including the 'User-Geo' header in cache keys enables the CDN to serve different cached responses based on the user's geolocation. This approach balances caching efficiency with personalized content delivery, as the CDN can cache a separate copy for each geographic region without requiring a cache miss for every request.

Answer

Configure cache keys based on URL and query parameters

Answer

Use signed URLs for personalized content

Answer

Serve personalized content from the origin and use Cloud CDN only for static content

Question 15

A developer is migrating a stateful application to GKE. The application requires persistent storage with high IOPS for a database. Which storage option is most suitable?

Accepted Answer

Persistent Disk SSD. Persistent Disk SSD (pd-ssd) is the most suitable option for a stateful database on GKE requiring high IOPS because it provides block storage with consistent, high-performance IOPS and can be dynamically provisioned via PersistentVolumeClaims. Unlike Local SSD, pd-ssd persists data independently of the node lifecycle, ensuring data durability during pod rescheduling or node failures.

Answer

Local SSD

Answer

Cloud Storage Fuse

Answer

Persistent Disk Standard