Google PCA Analyze and optimize technical and business processes Practice Test 2 — 15 Questions

Question 1

You are a cloud architect for an e-commerce company. Their application runs on Google Kubernetes Engine (GKE) with a Regional cluster. The application consists of a frontend service, a backend service, and a Redis cache. Traffic is routed via an external HTTP(S) Load Balancer to the frontend. Recently, customers have reported intermittent 502 Bad Gateway errors during peak hours. The frontend logs show 'upstream connect error or disconnect/reset before headers. retried and limit reset' errors. The backend service is deployed with 3 replicas, each with resource requests of 1 CPU and 2 GB memory. The cluster autoscaler is enabled with a minimum of 3 nodes and a maximum of 10 nodes, using e2-standard-4 instances. The backend service's HPA is configured with CPU utilization target of 80%. During peak hours, CPU utilization on the backend pods reaches 90%, but the HPA does not scale up. The cluster has sufficient node capacity. What should you do to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lower the HPA CPU target to 60% and increase the number of replicas min to 5.. The HPA is configured with a CPU utilization target of 80%, but during peak hours, CPU utilization reaches 90% without triggering scale-up. This indicates that the HPA's target utilization is too high relative to the actual load, causing the HPA to not scale because the average CPU utilization across pods may still be below the target when considering the metric calculation. Lowering the HPA CPU target to 60% ensures that the HPA triggers scaling earlier, and increasing the minimum replicas to 5 provides a baseline capacity to absorb traffic spikes, preventing the upstream connect errors from the backend being overwhelmed.

Answer

Change the HPA to use memory utilization instead of CPU.

Answer

Increase the backend service's max connections per pod in the backendConfig.

Answer

Increase the maximum number of nodes in the cluster autoscaler to 20.

Question 2

A company is using Cloud NAT to allow instances in a private subnet to access the internet for updates. The security team wants to audit outbound connections. Which TWO steps should be taken to enable flow logs for Cloud NAT?

Accepted Answer

Configure a log sink to export Cloud NAT logs to BigQuery. Cloud NAT flow logs provide detailed records of outbound connections and are enabled directly on the Cloud NAT gateway itself. Option B is correct because configuring a log sink to export Cloud NAT logs to BigQuery is a valid step to audit outbound connections, but the primary step to enable logging is to update the existing Cloud NAT gateway to enable flow logs (Option E). Together, these two steps (B and E) allow you to capture and analyze outbound traffic for auditing.

Answer

Enable private Google access on the subnet

Answer

Enable VPC Flow Logs on the subnet

Answer

Create a new Cloud NAT gateway with logging enabled

Question 3

A team deployed the Terraform configuration shown in the exhibit. They observe that Cloud NAT is not translating traffic from the private subnet as expected. What is the most likely cause?

Accepted Answer

The Cloud Router is not in the same VPC network as the private subnet. Cloud NAT requires a Cloud Router to be in the same VPC network as the subnet whose traffic needs translation. If the Cloud Router is in a different VPC network, the NAT gateway cannot establish the necessary BGP sessions or route traffic from the private subnet, causing NAT to fail silently.

Answer

The log filter is set to ERRORS_ONLY, which suppresses all logs

Answer

The NAT IP allocation is manual and no IPs were specified

Answer

The subnet is not included in the source_subnetwork_ip_ranges_to_nat list

Question 4

A startup runs a web application on Google Kubernetes Engine (GKE) with 3 replicas serving user traffic. They use Cloud SQL for the database. Recently, the application experienced intermittent timeouts during peak hours. Monitoring shows high CPU usage on the GKE nodes and increased database connection pool exhaustion. The team is looking for a cost-effective solution that minimizes architectural changes. The application is stateless. What should they do?

Accepted Answer

Increase the number of pod replicas and configure a connection pooler like PgBouncer for Cloud SQL. The application is stateless and experiencing database connection pool exhaustion alongside high CPU on GKE nodes. Increasing pod replicas distributes the CPU load across more pods, while adding a connection pooler like PgBouncer reduces the number of direct connections to Cloud SQL, preventing pool exhaustion without requiring database tier changes. This approach is cost-effective because it optimizes existing resources rather than scaling infrastructure.

Answer

Add more nodes to the GKE cluster and enable cluster autoscaling

Answer

Vertically scale the GKE node pool to larger machine types and increase Cloud SQL tier

Answer

Set up a Cloud SQL read replica and route read queries to it

Question 5

Drag and drop the steps to implement a disaster recovery plan using Cloud Storage and Cloud Functions in the correct order.

Accepted Answer

Enable versioning on the primary bucket, then create a Cloud Function to copy new objects to the DR bucket, then test the procedure.. Versioning protects against accidental deletion. The Cloud Function copies objects to the DR bucket.

Answer

Create a Cloud Function to copy new objects to the DR bucket, then enable versioning on the primary bucket, then test.

Answer

Create a Cloud Function, then test, then enable versioning.

Answer

Enable versioning, then test, then create the Cloud Function.

Question 6

Match each GCP database service to its type.

Accepted Answer

Cloud SQL: Relational database. Correct matches: Cloud SQL (Relational), Firestore (NoSQL document), Bigtable (NoSQL wide-column). Common confusions include mistaking Cloud Spanner or Memorystore for other types, or confusing Datastore with cache services.

Answer

Cloud Spanner: NoSQL document database

Answer

Memorystore: Relational database

Answer

Datastore: In-memory cache

Question 7

Match each GCP migration term to its description.

Accepted Answer

Migrate for Compute Engine: Migrates virtual machines to Compute Engine with minimal downtime.. Correct matches: Migrate for Compute Engine migrates VMs; Cloud Storage Transfer Service handles online data transfers; Transfer Appliance is a physical device for large datasets; Database Migration Service migrates databases to Cloud SQL. Common confusions include swapping the roles of these services.

Answer

Migrate for Compute Engine: Transfers data from online sources to Cloud Storage.

Answer

Cloud Storage Transfer Service: Physical device to transfer large datasets to Google Cloud.

Question 8

A startup deploys a web application on Compute Engine instances behind an HTTP load balancer. They need to handle unpredictable spikes in traffic with minimal operational overhead. What is the simplest scaling approach?

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization. Using a managed instance group with autoscaling automatically adds/removes instances based on demand, requiring minimal manual intervention. Other options either require more complex setup or are not optimal.

Answer

Set up a Kubernetes cluster with horizontal pod autoscaling

Answer

Migrate the application to Cloud Run

Answer

Add more instances manually during peak hours

Question 9

A company stores backup data in Cloud Storage. They observe high egress costs when clients download backups. Additionally, they must retain backups for 7 years for compliance. Which optimization should they implement first?

Accepted Answer

Enable requester pays on the bucket. High egress costs occur when clients download backups, and enabling requester pays shifts these costs to the clients. This directly addresses the cost issue without changing storage class or retention. Requester pays is the first optimization because it resolves the immediate cost problem while lifecycle rules or storage class changes address separate concerns like retention or storage cost.

Answer

Use lifecycle rules to transition to Archive after 30 days and delete after 7 years

Answer

Set up a Cloud CDN for backup downloads

Answer

Move the backup data to Archive storage class

Question 10

A company runs a streaming data pipeline using Dataflow to process real-time data and insert into BigQuery. Recently, workers are frequently failing with out-of-memory errors and the pipeline latency is increasing. What should they do to resolve the issue?

Accepted Answer

Enable Dataflow Streaming Engine. Dataflow Streaming Engine offloads the streaming data processing state and shuffle data from worker memory to a backend service, reducing memory pressure on workers. This directly addresses out-of-memory errors and latency increases without requiring manual scaling or machine type changes. It is the recommended solution for streaming pipelines experiencing memory bottlenecks.

Answer

Increase the worker machine type and memory

Answer

Use Cloud Pub/Sub for buffering and then load into BigQuery in batches

Answer

Enable autoscaling and increase the maximum number of workers

Question 11

A company uses Cloud SQL for PostgreSQL for their transactional database. They need a disaster recovery solution that provides cross-region failover with a recovery point objective (RPO) of less than 1 minute. Which solution meets these requirements?

Accepted Answer

Create a cross-region read replica and promote it during failover. A cross-region read replica in Cloud SQL for PostgreSQL can be promoted to a standalone instance during a disaster, enabling failover to another region. The replica uses PostgreSQL's native streaming replication, which typically provides an RPO of less than 1 minute because changes are replicated asynchronously but with very low latency. This meets the stated RPO requirement without needing to redesign the application for global consistency.

Answer

Use Cloud Spanner for global strong consistency

Answer

Use a Cloud SQL for PostgreSQL instance with multiple zones

Answer

Take daily automated backups and restore in another region

Question 12

A development team uses Cloud Build for their CI/CD pipeline. They want to reduce build times. Which action is most effective?

Accepted Answer

Enable parallel builds by separating build steps into multiple jobs. Enabling parallel builds by separating build steps into multiple jobs reduces total build time by running independent steps concurrently. Other options are less effective or add complexity.

Answer

Store build artifacts in a Cloud Storage bucket and reuse them

Answer

Use more powerful build machines by specifying larger machine types

Answer

Use a Cloud Run service to run builds asynchronously

Question 13

A financial institution stores sensitive customer data in Cloud Storage. They need to audit all data access and prevent unauthorized data exfiltration. They also require context-aware access controls based on user location and device. Which Google Cloud service should they configure?

Accepted Answer

VPC Service Controls with the perimeter set to the data layer. VPC Service Controls (option C) is correct because it creates a security perimeter around Google Cloud APIs, including Cloud Storage, to prevent unauthorized data exfiltration (e.g., copying data to an external project) while allowing context-aware access controls based on user location and device via Access Context Manager. This directly addresses the requirement for both audit (via Cloud Audit Logs integrated with the perimeter) and exfiltration prevention, which other services like DLP or Access Transparency alone cannot enforce.

Answer

Cloud Data Loss Prevention (DLP) for inspecting data

Answer

Cloud Audit Logs and Cloud Monitoring for alerts

Answer

Access Transparency logs for audit

Question 14

A company uses Cloud CDN to accelerate content delivery for their global user base. They notice a low cache hit ratio, and they also need to deliver personalized content based on user geolocation. What should they do?

Accepted Answer

Set appropriate Cache-Control headers and use cache keys including the 'User-Geo' header. Setting appropriate Cache-Control headers (e.g., s-maxage, private vs. public) allows Cloud CDN to cache content effectively, while including the 'User-Geo' header in cache keys enables the CDN to serve different cached responses based on the user's geolocation. This approach balances caching efficiency with personalized content delivery, as the CDN can cache a separate copy for each geographic region without requiring a cache miss for every request.

Answer

Configure cache keys based on URL and query parameters

Answer

Use signed URLs for personalized content

Answer

Serve personalized content from the origin and use Cloud CDN only for static content

Question 15

A developer is migrating a stateful application to GKE. The application requires persistent storage with high IOPS for a database. Which storage option is most suitable?

Accepted Answer

Persistent Disk SSD. Persistent Disk SSD (pd-ssd) is the most suitable option for a stateful database on GKE requiring high IOPS because it provides block storage with consistent, high-performance IOPS and can be dynamically provisioned via PersistentVolumeClaims. Unlike Local SSD, pd-ssd persists data independently of the node lifecycle, ensuring data durability during pod rescheduling or node failures.

Answer

Local SSD

Answer

Cloud Storage Fuse

Answer

Persistent Disk Standard