Google PCA Design and plan a cloud solution architecture — 20 Questions

Question 1

A company has a hub-and-spoke VPC topology with multiple on-premises locations connected via Cloud VPN to the hub VPC. They notice IP conflicts because overlapping CIDR ranges are used in different spokes. The network team wants to allow communication between spokes without re-IPing. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud NAT in each spoke and private routing via the hub with network tags to distinguish ranges.. Using Cloud VPN tunnels between spokes through the hub allows the hub to route traffic between spokes based on the tunnel interfaces. By assigning unique IP addresses to each tunnel endpoint (e.g., 10.254.0.1 for Spoke A and 10.254.0.2 for Spoke B), the hub can forward packets without relying on the overlapping spoke CIDRs. The spokes use static routes pointing to their respective tunnel interfaces, ensuring that traffic is encapsulated over IPsec and decapsulated at the destination, bypassing the IP conflict. This approach avoids re-IPing while enabling communication, though it introduces additional overhead and complexity.

Answer

Use Cloud VPN tunnels between spokes through the hub.

Answer

Configure static routes in the hub to summarize ranges with a smaller prefix.

Answer

Create VPC peering between each spoke VPC.

Question 2

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

Accepted Answer

Cloud Run (fully managed).. Cloud Run (fully managed) is the correct choice because it is a serverless container platform that scales to zero, meaning no cost when idle, and scales automatically with demand. It requires no infrastructure management, perfect for a startup with limited operational experience. Option A (App Engine Standard) is wrong because it only supports specific runtimes (e.g., Python, Java, Go), not custom containers, and is not ideal for containerized applications. Option B (GKE) is wrong because it requires managing a Kubernetes cluster, including node pools, which adds operational overhead. Option C (Compute Engine with managed instance group) is wrong because it still requires provisioning and scaling configuration, and does not scale to zero.

Answer

App Engine Standard Environment with a custom runtime.

Answer

Google Kubernetes Engine (GKE) with a multi-node pool.

Answer

Compute Engine with a managed instance group.

Question 3

You need to store object data that is accessed infrequently (once a quarter) but must be retained for 10 years for compliance. Which storage class is the most cost-effective?

Accepted Answer

Coldline. For data accessed once a quarter (every 90 days), Coldline is the most cost-effective storage class. Coldline offers lower storage cost than Standard or Nearline, with retrieval costs lower than Archive's. The 90-day minimum storage duration aligns with the retention requirement, and retrieval time (typically under 1 minute) is acceptable for infrequent access. Archive is designed for data accessed less than once a year and has higher retrieval costs, making it less cost-effective for quarterly access.

Answer

Archive

Answer

Standard

Answer

Nearline

Question 4

A company is designing a VPC architecture for a multi-tenant SaaS platform. Each tenant has isolated workloads that must not communicate with each other. They also need centralized network security and logging. Which VPC design meets these requirements?

Accepted Answer

Use a Shared VPC with separate subnets for each tenant and firewall rules to enforce isolation. Using a Shared VPC with separate subnets per tenant and firewall rules to enforce isolation provides centralized network security and logging while keeping tenants isolated. Option A is incorrect because dedicated Cloud VPN connections per tenant do not provide isolation within the VPC and are more for hybrid connectivity. Option C is incorrect because a single VPC with network tags and IAP tunnels does not enforce strict isolation between tenants and relies on tags which can be misconfigured. Option D is incorrect because peered VPCs for each tenant with Cloud NAT would create multiple VPCs but does not provide centralized management and logging as easily as a Shared VPC.

Answer

Dedicated Cloud VPN connections per tenant

Answer

Single VPC with network tags and IAP tunnels

Answer

Peered VPCs for each tenant with Cloud NAT

Question 5

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Accepted Answer

The service account lacks IAM permissions to read from Cloud Storage. The web server fails to read from Cloud Storage because the service account attached to the Compute Engine instance lacks the necessary IAM permissions (e.g., roles/storage.objectViewer) on the storage bucket. Although the command includes --scopes=cloud-platform, which grants broad API access, IAM permissions are distinct from OAuth scopes. The service account must be granted explicit IAM roles to access Cloud Storage resources. Option A is incorrect because a service account is specified and attached via --service-account. Option B is incorrect because the boot disk type (pd-ssd) is compatible and does not affect storage access. Option C is incorrect because the tags http-server and https-server are used for firewall rules and do not impact outbound traffic to Cloud Storage.

Answer

The service account is not attached to the instance

Answer

The tags http-server and https-server block outbound traffic

Answer

The boot disk type is SSD, which is not compatible with Cloud Storage

Question 6

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Accepted Answer

The developer is assigned only the objectViewer role. The most likely reason is that the developer (admin@example.com) has only the roles/storage.objectViewer role on the bucket, which allows read-only access. The roles/storage.objectAdmin role is assigned to a service account, not to the developer. Therefore, the developer cannot upload files. Option A is incorrect because an organization policy denying all write operations would be a different mechanism and not indicated. Option B is incorrect because the developer is a member of the project (as shown). Option C is incorrect because IAM permissions are additive, not overriding; the service account's permissions do not affect the developer's effective permissions.

Answer

An organization policy denies all write operations

Answer

The developer is not a member of the project

Answer

The service account my-sa overrides the developer's permissions

Question 7

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Accepted Answer

Deployment with pod anti-affinity rules spread across zones. Deployments support rolling updates for zero-downtime deployments, and pod anti-affinity rules can be configured to spread pods across different zones, ensuring high availability. StatefulSets are intended for stateful workloads requiring stable network identities and persistent storage, not for stateless microservices. DaemonSets run one pod per node, typically for node-level services like logging, not for scaling microservices. Jobs are for batch processing and do not provide rolling updates or high availability across zones.

Answer

StatefulSet with volumeClaimTemplates for persistent storage

Answer

Job for batch processing

Answer

DaemonSet to ensure one pod per node

Question 8

Your company has migrated its legacy web application from a single Compute Engine instance to a managed instance group (MIG) behind an HTTP(S) load balancer. The application was updated to a new version as part of the migration. After the migration, users report intermittent 502 Bad Gateway errors. The application logs show no errors, and the load balancer backend health checks are reported as healthy. On investigation, the developers discover that the new version requires a specific environment variable for authentication to a downstream service. This variable was set manually on the original instance but is missing from the MIG's instance template. The health check endpoint does not depend on this variable and always returns a 200 status even when the variable is absent. As a result, instances created from the template are considered healthy by the load balancer, but when they receive requests that require authentication, they fail and return a 502 error to the client. What is the most likely cause of the 502 errors?

Accepted Answer

The missing environment variable causes authentication failures on new instances.. The 502 errors occur because the new application version requires a specific environment variable for authentication to a downstream service. The health check endpoint does not depend on this variable, so instances are marked healthy even though they cannot authenticate real requests. When the load balancer routes traffic to these instances, the missing variable causes authentication failures, leading to 502 Bad Gateway errors.

Answer

The health check is configured to check the old application path, which no longer exists.

Answer

The load balancer's backend timeout is too short for the application's response time.

Answer

The MIG is not scaling out fast enough to handle peak traffic.

Question 9

Refer to the exhibit. An engineer is investigating why web-01 was removed from the load balancer target pool. What is the most likely root cause?

Accepted Answer

The firewall rule allowing traffic from web-01 to db-01 on port 3306 has been removed or misconfigured.. The exhibit shows that web-01 was removed from the load balancer target pool. In Google Cloud, a load balancer health check determines instance eligibility; if the health check fails, the instance is automatically removed. The most likely root cause is that the firewall rule allowing traffic from web-01 to db-01 on port 3306 has been removed or misconfigured, which would cause the health check (which often tests connectivity to a backend service like a database) to fail, leading to removal.

Answer

The database instance db-01 is running out of memory and rejecting connections.

Answer

The load balancer health check is misconfigured to use an incorrect port.

Answer

The instance web-01 is running an outdated version of the web server software.

Question 10

A company is migrating on-premises workloads to Google Cloud. They have a critical application that requires consistent low-latency access to a database, with read replicas in multiple regions for disaster recovery. The application is expected to grow by 10x over the next year. Which database service and configuration should the architect choose to meet these requirements?

Accepted Answer

Use Cloud Spanner with multi-region configuration. Cloud Spanner with a multi-region configuration is the correct choice because it provides strong global consistency, low-latency reads and writes across regions, and automatic horizontal scaling to handle a 10x growth in workload. Its multi-region replication ensures synchronous replication for disaster recovery while maintaining ACID transactions, which is critical for a database requiring consistent low-latency access.

Answer

Use Cloud Bigtable with multi-region replication

Answer

Use Cloud SQL for PostgreSQL with cross-region read replicas

Answer

Use Firestore in native mode with multi-region location

Question 11

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Accepted Answer

Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage. Enabling CMEK on Cloud SQL and Cloud Storage allows the company to use their own encryption keys, which is often required by PCI DSS to demonstrate control over key management. CMEK ensures data at rest is encrypted with keys managed via Cloud KMS, providing auditability and separation of duties beyond Google-managed default encryption.

Answer

Configure client-side encryption in the application code

Answer

Rely on Google-managed default encryption for all data

Answer

Use Cloud HSM with a key generated outside of Google Cloud

Question 12

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Accepted Answer

The VM was created without an external IP address. The most likely reason for the timeout is that the VM was created without an external (public) IP address. Without an external IP, the VM is not directly reachable from the internet, even if nginx is running and firewall rules allow HTTP traffic. The timeout occurs because the internet has no route to the VM's private IP address.

Answer

The VM is in a subnet without a Cloud NAT

Answer

The firewall rule allowing HTTP traffic is missing

Answer

The startup script failed to install nginx

Question 13

A media streaming company is deploying a new video transcoding pipeline on Google Cloud. The pipeline receives raw video files uploaded to Cloud Storage, triggers a Cloud Function that submits transcoding jobs to a Compute Engine worker pool, and stores the transcoded output in another Cloud Storage bucket. The workers are managed by a managed instance group (MIG) running a custom container image. Currently, when there is a spike in uploads, the MIG takes 5-7 minutes to scale up new workers, causing processing delays. The architect needs to reduce the time to add new workers to under 2 minutes. The workers are stateless and the container image is about 2 GB. What should the architect do?

Accepted Answer

Create a custom Compute Engine image that includes the container runtime and pre-pulled container. Creating a custom Compute Engine image that includes the container runtime and pre-pulls the 2 GB container image eliminates the need to download the image during scale-up. This reduces the instance startup time from 5-7 minutes to under 2 minutes, as the container is already cached locally on the image, bypassing the network pull delay.

Answer

Use Cloud Run instead of Compute Engine to run the transcoding workers

Answer

Increase the minimum number of instances in the MIG to 10

Answer

Replace the Compute Engine workers with Cloud Functions to handle the transcoding

Question 14

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single on-premises server and uses a local MySQL database. The company wants to minimize changes to the application code while improving scalability and reliability. Which migration strategy should the architect recommend?

Accepted Answer

Rehost the application on Compute Engine and use Cloud SQL for MySQL as the database.. Rehosting (lift-and-shift) the monolithic application to Compute Engine with Cloud SQL for MySQL minimizes code changes while improving scalability and reliability. Cloud SQL provides managed MySQL with automated backups, replication, and failover, addressing the need for reliability without requiring application refactoring.

Answer

Refactor the application into microservices and deploy on Google Kubernetes Engine.

Answer

Containerize the application with Docker and run it on Cloud Run.

Answer

Migrate the database to Firestore and rewrite the application to use Firestore APIs.

Question 15

A global e-commerce platform is experiencing intermittent latency spikes during flash sales. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster. The architecture includes a frontend service, a product catalog service using Cloud Spanner, and an order processing service using Cloud Pub/Sub. During high load, the catalog service shows increased query latency, and some requests time out. What should the architect prioritize to address the issue?

Accepted Answer

Enable Cloud Spanner interleaved tables and add secondary indexes for common query filters.. The issue is specifically with Cloud Spanner query latency under high load. Enabling interleaved tables and adding secondary indexes optimizes data locality and query performance, reducing the need for expensive cross-table joins and full table scans. This directly addresses the root cause of increased latency and timeouts in the catalog service.

Answer

Use Cloud CDN to cache product catalog responses.

Answer

Increase the number of nodes in the GKE node pool.

Answer

Migrate the catalog service from Cloud Spanner to Cloud Bigtable for better read performance.

Question 16

A startup is developing a real-time analytics dashboard that ingests data from IoT devices. The data volume is unpredictable but can spike to millions of events per second. The dashboard must display near real-time aggregations with sub-second latency. Which Google Cloud architecture should the architect recommend?

Accepted Answer

Ingest via Cloud Pub/Sub, process with Cloud Dataflow, store in Cloud Bigtable, and query from the dashboard.. Cloud Pub/Sub provides scalable, asynchronous ingestion for unpredictable IoT data spikes, Cloud Dataflow enables stream processing for near real-time aggregations with sub-second latency, and Cloud Bigtable offers low-latency, high-throughput storage ideal for serving aggregated results directly to a dashboard. This combination meets the requirements of unpredictable volume, real-time processing, and low-latency queries.

Answer

Ingest via Cloud IoT Core directly to Cloud Bigtable, then query with BigQuery.

Answer

Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in Cloud Storage, and query with BigQuery.

Answer

Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use Cloud SQL for aggregations.

Question 17

A financial services company is designing a multi-region disaster recovery architecture for a critical application. The application runs on Compute Engine with a stateful backend using Cloud Spanner. The Recovery Time Objective (RTO) is 1 hour, and the Recovery Point Objective (RPO) is 15 minutes. What architecture meets these requirements cost-effectively?

Accepted Answer

Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.. It uses Cloud Spanner's multi-region configuration, which provides synchronous replication across regions with automatic failover, meeting an RPO of 15 minutes (typically seconds) and an RTO of 1 hour. Active-active traffic load balancing with Compute Engine ensures that the application can immediately route traffic to the healthy region, minimizing downtime without the need for manual failover or backup/restore operations.

Answer

Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.

Answer

Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.

Answer

Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.

Question 18

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Accepted Answer

Grant the service account roles/storage.objectViewer on the bucket and remove all other bindings.. The principle of least privilege dictates that the service account should be granted only the minimal permissions required to read objects, which is roles/storage.objectViewer. By removing all other bindings, the bucket becomes accessible exclusively to that service account, ensuring that no other identities (users, groups, or other service accounts) can read the sensitive data. This approach directly enforces the requirement using IAM roles on the bucket resource.

Answer

Grant the service account roles/iam.serviceAccountUser on the bucket.

Answer

Use a signed URL to allow access for the service account.

Answer

Grant the service account roles/storage.admin on the bucket.

Question 19

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Accepted Answer

1. Verify that the VPC networks have non-overlapping IP ranges.
2. Create a VPC peering connection from Project A to Project B.
3. Create a VPC peering connection from Project B to Project A.
4. Verify the peering status and network connectivity.. VPC peering requires bidirectional connections; both sides must initiate peering. IP ranges must not overlap.

Answer

1. Verify that the VPC networks have non-overlapping IP ranges.
2. Create a VPC peering connection from Project A to Project B.
3. Verify the peering status and network connectivity. (No peering from Project B to Project A)

Answer

1. Create a VPC peering connection from Project A to Project B.
2. Create a VPC peering connection from Project B to Project A.
3. Verify that the VPC networks have non-overlapping IP ranges.
4. Verify the peering status and network connectivity.

Answer

1. Create a VPC peering connection from Project B to Project A.
2. Create a VPC peering connection from Project A to Project B.
3. Verify that the VPC networks have non-overlapping IP ranges.
4. Verify the peering status and network connectivity.

Question 20

Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.

Accepted Answer

Step 1: Identify the backup, Step 2: Create a new Cloud SQL instance, Step 3: Restore the backup to the new instance, Step 4: Redirect applications to the new instance.. Restoring to an existing instance may overwrite data; best practice is to restore to a new instance.

Answer

Step 1: Identify the backup, Step 2: Restore the backup to the existing instance, Step 3: Verify the data, Step 4: Redirect applications if needed.

Answer

Step 1: Create a new Cloud SQL instance, Step 2: Identify the backup, Step 3: Restore the backup to the new instance, Step 4: Redirect applications.

Answer

Step 1: Identify the backup, Step 2: Redirect applications to a new instance, Step 3: Restore the backup to the new instance, Step 4: Verify the restoration.