Google PCA Design and plan a cloud solution architecture Practice Test 2 — 15 Questions

Question 1

Which THREE are best practices for designing a highly available Cloud SQL for MySQL instance? (Choose 3)

Accepted Answer

Enable automatic backups. Automatic backups in Cloud SQL for MySQL provide point-in-time recovery (PITR) capabilities, which are essential for data durability and disaster recovery. Enabling automatic backups ensures that transaction logs are retained, allowing you to restore your database to any point within the backup retention period, typically up to 7 days.

Answer

Configure cross-region replication

Answer

Set a maintenance window in off-peak hours

Question 2

A company wants to deploy a stateful application with strict low-latency requirements across multiple zones in a single region. They need to minimize inter-zone latency. Which THREE actions should they take? (Choose 3)

Accepted Answer

Place application instances in the same zone to minimize network hops. Option A is correct because co-locating application instances in the same zone eliminates inter-zone network hops, which is the most direct way to minimize latency for a stateful, latency-sensitive workload. Option B is correct because zonal SSD persistent disks provide high-throughput, low-latency block storage that is physically attached within the same zone, avoiding the added latency of cross-zone or regional disk replication. Option D is correct because a regional internal TCP/UDP load balancer distributes traffic across instances within a region using a single internal IP, and when combined with same-zone placement it keeps the data path local and avoids unnecessary cross-zone hops. Option C is not appropriate because spreading instances across multiple zones in a managed instance group increases inter-zone latency, which contradicts the stated goal. Option E is not appropriate because Dedicated Interconnect addresses on-premises-to-cloud connectivity and does not reduce latency between zones within a single region.

Answer

Deploy instances in a managed instance group across multiple zones

Answer

Use Dedicated Interconnect for on-premises connection

Question 3

A company is migrating a critical on-premises application to Google Cloud. The application consists of a frontend web server that handles user requests and a backend database server that stores session state and processed data. The application is stateful because session data is stored in memory on the backend server. The company wants to minimize downtime during migration and ensure that the application can scale horizontally in the future. The current on-premises architecture has the web server and database server on separate physical machines. The web server communicates with the database server via a private network. The company expects that after migration, the application will need to handle double the current traffic. They also need to ensure that the architecture is resilient to zone failures within a single region. They are considering using Compute Engine for both the web and database servers, but they are open to other Google Cloud services. They have a requirement that the database must be relational and support ACID transactions. The database currently uses Microsoft SQL Server, but they are willing to migrate to a different database engine if it reduces operational overhead and provides better scalability. The team has limited experience with Google Cloud and wants to minimize architectural changes. Which course of action should the company take?

Accepted Answer

Migrate the web server to Compute Engine with a managed instance group and internal load balancer. Migrate the database to Cloud SQL for SQL Server with high availability across zones.. It preserves the existing stateful architecture by using Compute Engine with a managed instance group and internal load balancer for the web tier, and Cloud SQL for SQL Server with cross-zone high availability for the database. This minimizes architectural changes, supports horizontal scaling via the managed instance group, and provides zone-level resilience for the relational database with ACID transactions, meeting the requirement to handle double traffic while minimizing downtime.

Answer

Refactor the application to be stateless. Migrate the web server to App Engine and the database to Cloud SQL for PostgreSQL. Use Cloud Memorystore for session state.

Answer

Migrate the web server to Compute Engine and the database to Cloud Spanner. Use a global load balancer for the web server and Spanner for transactional consistency.

Answer

Lift and shift both web and database servers to Compute Engine. Use a managed instance group with autoscaling for the web server and a standalone VM for the database. Configure persistent disks for data.

Question 4

Refer to the exhibit. A user alice@example.com is unable to list objects in bucket 'bucket-b'. What is the most likely reason?

Accepted Answer

The condition restricts access only to bucket-a.. The IAM policy condition explicitly restricts access to resources with a name matching 'bucket-a'. Since the user is trying to list objects in 'bucket-b', the condition evaluates to false, and the IAM policy does not grant the required permissions. Without a matching condition, the effective permission set is empty, causing the list operation to fail.

Answer

The IAM policy is missing the roles/storage.objectAdmin role.

Answer

The condition expression is invalid.

Answer

The user needs the roles/storage.legacyBucketReader role.

Question 5

Refer to the exhibit. A user creates a snapshot of a persistent disk. Later, they want to create a new VM from this snapshot in the same project but in a different region (europe-west1). Which step is missing or incorrect?

Accepted Answer

The user must wait for the snapshot operation to complete before using it to create a VM.. A snapshot operation is asynchronous; the snapshot must reach the 'READY' state before it can be used to create a VM. Attempting to create a VM from a snapshot that is still being created will fail, as the snapshot data is not yet fully available.

Answer

The snapshot cannot be used to create a VM in a different region; the user must first create a disk in the same region and then replicate it.

Answer

The snapshot must be created with '--storage-location=europe-west1' to be usable in that region.

Answer

The user must specify the '--region' flag when creating the snapshot to make it available in europe-west1.

Question 6

Refer to the exhibit. A security team wants to ensure that the service account 'sa-compute' can only be used by the instance admin role. Currently, any user with 'iam.serviceAccountUser' on the project can impersonate it. Which change should be made to the policy?

Accepted Answer

Remove the 'roles/iam.serviceAccountUser' binding from the project policy and add a resource-level policy on the service account granting 'roles/iam.serviceAccountUser' only to 'developer@example.com'.. The exhibit shows a project-level IAM policy. The service account 'sa-compute' is granted 'roles/iam.serviceAccountUser' at the project level, meaning any user with that role on the project can impersonate it. To restrict usage, the policy should grant 'roles/iam.serviceAccountUser' on the service account itself to only specific users, not at the project level. The correct approach is to remove the project-level binding and add a resource-level policy on the service account.

Answer

Add a condition to the 'roles/iam.serviceAccountUser' binding that restricts access to only the instance admin.

Answer

Modify the project policy to change the 'roles/iam.serviceAccountUser' member to 'user:developer@example.com'.

Answer

Create a new custom role that combines 'roles/compute.instanceAdmin.v1' and 'roles/iam.serviceAccountUser' and assign it to 'developer@example.com'.

Question 7

Refer to the exhibit. A user creates a Cloud SQL for PostgreSQL instance and a Compute Engine VM. The VM cannot connect to the database. What is the most likely cause?

Accepted Answer

The Cloud SQL instance does not have a private IP assigned, but the VM is attempting to connect using the private IP.. Cloud SQL for PostgreSQL instances do not have a private IP by default; private IP must be explicitly enabled during or after instance creation. If the Compute Engine VM is configured to connect using a private IP address, the connection will fail because no private IP is assigned to the Cloud SQL instance. The most likely cause is therefore the missing private IP assignment.

Answer

The Cloud SQL instance requires SSL connections, and the client is not using SSL.

Answer

The VM's firewall is blocking egress to port 5432 on the Cloud SQL public IP.

Answer

The authorized networks setting is too permissive; it should be restricted to the VM's public IP.

Question 8

Refer to the exhibit. An engineer is investigating why web-01 was removed from the load balancer target pool. What is the most likely root cause?

Accepted Answer

The firewall rule allowing traffic from web-01 to db-01 on port 3306 has been removed or misconfigured.. The exhibit shows that web-01 was removed from the load balancer target pool. In Google Cloud, a load balancer health check determines instance eligibility; if the health check fails, the instance is automatically removed. The most likely root cause is that the firewall rule allowing traffic from web-01 to db-01 on port 3306 has been removed or misconfigured, which would cause the health check (which often tests connectivity to a backend service like a database) to fail, leading to removal.

Answer

The database instance db-01 is running out of memory and rejecting connections.

Answer

The load balancer health check is misconfigured to use an incorrect port.

Answer

The instance web-01 is running an outdated version of the web server software.

Question 9

Refer to the exhibit. An engineer is reviewing health check logs for a target pool. The instance web-01 is still serving traffic despite two consecutive unhealthy health checks. Why is the instance not removed from the target pool?

Accepted Answer

The instance was removed after the second failure but then re-added after the next healthy check, so it is serving traffic again.. The instance was removed from the target pool after the second consecutive unhealthy health check, but it was immediately re-added after the next healthy health check. This happens when the health check's `unhealthyThreshold` is set to 2, meaning two consecutive failures trigger removal, but the instance then passes a subsequent health check, causing it to be re-added and resume serving traffic. The logs show the instance is still serving traffic because it was removed and then re-added within the same monitoring window.

Answer

The health check's timeoutSec is too high, causing delayed removal.

Answer

The forwarding rule is not using the target pool, so health checks have no effect.

Answer

The healthyThreshold is set to 2, requiring two healthy checks before re-adding, but the instance only had one healthy check.

Question 10

Refer to the exhibit. An engineer created an instance with a startup script that references a Cloud Storage bucket. The instance boots but the startup script fails. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket 'my-bucket' does not exist or the object 'startup.sh' is missing.. The error message indicates that the startup script cannot find the resource at gs://my-bucket/startup.sh. This could be because the bucket does not exist, the object does not exist, or the instance does not have permission to access the bucket. Given that the bucket is named 'my-bucket', it's likely that the bucket does not exist or the name is incorrect.

Answer

The startup script is not executable.

Answer

The instance does not have the appropriate IAM permissions to read from Cloud Storage.

Answer

The instance has no network connectivity to access Cloud Storage.

Question 11

A financial services company is designing a new payment processing platform on Google Cloud. Regulatory requirements mandate that all data must remain within the borders of the European Union (EU). The company wants to ensure that no data is stored or processed outside the EU. Which Google Cloud feature should they use to enforce this requirement?

Accepted Answer

Assured Workloads for EU. Assured Workloads for EU is specifically designed to enforce data residency and compliance requirements for workloads that must remain within the European Union. It provides technical controls that prevent data from leaving the EU and includes monitoring to demonstrate compliance. Organization Policy constraints can restrict resource locations but do not provide the same level of assurance for data residency across all services.

Answer

VPC Service Controls

Answer

Cloud Data Loss Prevention (DLP)

Answer

Organization Policy constraints

Question 12

A retail company runs a Java application on Compute Engine in a single zone (us-central1-a). The application reads product images from a Cloud Storage bucket and writes order data to a Cloud SQL for MySQL instance. The company wants to improve the application's availability without changing its code. The application cannot be made stateless. What should you do?

Accepted Answer

Create a managed instance group with a regional distribution across multiple zones, and configure an HTTP(S) load balancer with a health check. Ensure the application reads and writes to Cloud Storage and Cloud SQL, which are already regional or multi-regional services.. A regional managed instance group distributes VMs across multiple zones, and an HTTP(S) load balancer with health checks ensures traffic goes only to healthy instances. Since the application relies on Cloud Storage and Cloud SQL, which are regional or multi-regional, the architecture survives a zonal failure without code changes. This is the recommended pattern for improving availability of a stateful application that uses managed services.

Answer

Convert the application to a container and deploy it to a single-node Google Kubernetes Engine cluster in us-central1-a. Use a PersistentVolume for order data and a Cloud Storage FUSE mount for images.

Answer

Enable live migration on the existing VM and create a snapshot schedule for the boot disk. Configure an alerting policy to notify the operations team if the VM becomes unresponsive.

Answer

Create an unmanaged instance group in us-central1-a and add a second VM to it. Configure a health check and an HTTP(S) load balancer to distribute traffic across both VMs.

Question 13

Your organization is designing a new containerized order-processing service on Google Cloud. The service must accept bursty traffic that can spike from near-zero to thousands of requests per second, and the platform team wants to avoid managing nodes or node pools. Requests must be served with the lowest possible cold-start latency, and the service must scale down to zero when idle. Which compute option should the architecture use?

Accepted Answer

Cloud Run with CPU allocated during request processing and a minimum instance count of zero. The scenario requires three things: no node management, scale-to-zero, and low cold-start latency under bursty request traffic. A fully managed serverless container runtime that allocates CPU only during request processing satisfies all three without a cluster or VM fleet. Kubernetes and managed instance groups both introduce node or cluster administration and cannot idle at zero cost.

Answer

Compute Engine managed instance group with an autoscaler and a global external Application Load Balancer

Answer

Google Kubernetes Engine Autopilot with a Horizontal Pod Autoscaler on CPU utilization

Answer

App Engine standard environment with automatic scaling and a warmup request handler

Question 14

A company is designing a hybrid cloud architecture that connects its on-premises data center to Google Cloud. They need to ensure high availability and low latency for traffic between the two environments. They also require that the connection supports up to 10 Gbps and provides encryption. Which two Google Cloud connectivity options should they consider? (Choose two.)

Accepted Answer

Dedicated Interconnect. HA VPN provides encrypted connectivity with high availability, and Dedicated Interconnect offers high bandwidth and low latency. Together, they can meet the requirements for encryption, high availability, and up to 10 Gbps. Partner Interconnect lacks native encryption, Cloud CDN is for content delivery, and Cloud Router is a routing service, not a connectivity option.

Answer

Cloud Router

Answer

Partner Interconnect

Answer

Cloud CDN

Question 15

A retail company is designing its Google Cloud landing zone. The security team requires that all projects created under the organization automatically inherit a defined set of IAM bindings, and that new projects are never created outside the corporate folder hierarchy. Which combination of Google Cloud resources should the architect design to meet these requirements?

Accepted Answer

Define IAM bindings at the organization and folder nodes, then enforce project creation location with the `constraints/resourcemanager.projectCreationLocation` and `constraints/resourcemanager.allowedExportDestinations` organization policies.. Inheritance in Cloud IAM flows down the resource hierarchy, so bindings placed on the organization or a folder are automatically effective on every descendant project. Organization policies then act as guardrails that constrain where projects may be created, which keeps the hierarchy intact regardless of who runs the create command. Combining inherited bindings with projectCreationLocation and allowedExportDestinations constraints enforces both requirements declaratively, rather than relying on documentation or manual steps.

Answer

Use a Terraform module that creates projects with predefined IAM policies and run it from a CI/CD pipeline with a fixed service account.

Answer

Create an Organization Policy with the `constraints/resourcemanager.allowedExportDestinations` constraint and apply IAM bindings manually to each new project.

Answer

Create a dedicated shared VPC host project and attach every new project as a service project, relying on VPC Service Controls to restrict project creation.