Google PCA Design and plan a cloud solution architecture Practice Test 2 — 15 Questions

Question 1

A startup is developing a real-time analytics dashboard that ingests data from IoT devices. The data volume is unpredictable but can spike to millions of events per second. The dashboard must display near real-time aggregations with sub-second latency. Which Google Cloud architecture should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ingest via Cloud Pub/Sub, process with Cloud Dataflow, store in Cloud Bigtable, and query from the dashboard.. Cloud Pub/Sub provides scalable, asynchronous ingestion for unpredictable IoT data spikes, Cloud Dataflow enables stream processing for near real-time aggregations with sub-second latency, and Cloud Bigtable offers low-latency, high-throughput storage ideal for serving aggregated results directly to a dashboard. This combination meets the requirements of unpredictable volume, real-time processing, and low-latency queries.

Answer

Ingest via Cloud IoT Core directly to Cloud Bigtable, then query with BigQuery.

Answer

Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in Cloud Storage, and query with BigQuery.

Answer

Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use Cloud SQL for aggregations.

Question 2

A financial services company is designing a multi-region disaster recovery architecture for a critical application. The application runs on Compute Engine with a stateful backend using Cloud Spanner. The Recovery Time Objective (RTO) is 1 hour, and the Recovery Point Objective (RPO) is 15 minutes. What architecture meets these requirements cost-effectively?

Accepted Answer

Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.. It uses Cloud Spanner's multi-region configuration, which provides synchronous replication across regions with automatic failover, meeting an RPO of 15 minutes (typically seconds) and an RTO of 1 hour. Active-active traffic load balancing with Compute Engine ensures that the application can immediately route traffic to the healthy region, minimizing downtime without the need for manual failover or backup/restore operations.

Answer

Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.

Answer

Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.

Answer

Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.

Question 3

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Accepted Answer

Grant the service account roles/storage.objectViewer on the bucket and remove all other bindings.. The principle of least privilege dictates that the service account should be granted only the minimal permissions required to read objects, which is roles/storage.objectViewer. By removing all other bindings, the bucket becomes accessible exclusively to that service account, ensuring that no other identities (users, groups, or other service accounts) can read the sensitive data. This approach directly enforces the requirement using IAM roles on the bucket resource.

Answer

Grant the service account roles/iam.serviceAccountUser on the bucket.

Answer

Use a signed URL to allow access for the service account.

Answer

Grant the service account roles/storage.admin on the bucket.

Question 4

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Accepted Answer

1. Verify that the VPC networks have non-overlapping IP ranges.
2. Create a VPC peering connection from Project A to Project B.
3. Create a VPC peering connection from Project B to Project A.
4. Verify the peering status and network connectivity.. VPC peering requires bidirectional connections; both sides must initiate peering. IP ranges must not overlap.

Answer

1. Verify that the VPC networks have non-overlapping IP ranges.
2. Create a VPC peering connection from Project A to Project B.
3. Verify the peering status and network connectivity. (No peering from Project B to Project A)

Answer

1. Create a VPC peering connection from Project A to Project B.
2. Create a VPC peering connection from Project B to Project A.
3. Verify that the VPC networks have non-overlapping IP ranges.
4. Verify the peering status and network connectivity.

Answer

1. Create a VPC peering connection from Project B to Project A.
2. Create a VPC peering connection from Project A to Project B.
3. Verify that the VPC networks have non-overlapping IP ranges.
4. Verify the peering status and network connectivity.

Question 5

Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.

Accepted Answer

Step 1: Identify the backup, Step 2: Create a new Cloud SQL instance, Step 3: Restore the backup to the new instance, Step 4: Redirect applications to the new instance.. Restoring to an existing instance may overwrite data; best practice is to restore to a new instance.

Answer

Step 1: Identify the backup, Step 2: Restore the backup to the existing instance, Step 3: Verify the data, Step 4: Redirect applications if needed.

Answer

Step 1: Create a new Cloud SQL instance, Step 2: Identify the backup, Step 3: Restore the backup to the new instance, Step 4: Redirect applications.

Answer

Step 1: Identify the backup, Step 2: Redirect applications to a new instance, Step 3: Restore the backup to the new instance, Step 4: Verify the restoration.

Question 6

Match each Google Cloud service to its primary purpose.

Accepted Answer

Cloud VPC: Isolated virtual network for GCP resources. These are core networking services in GCP. Cloud VPC provides isolated virtual networks, Cloud Load Balancing distributes traffic, Cloud CDN caches content at the edge, and Cloud NAT enables outbound internet for private instances. Common confusion: mixing up VPC and Load Balancing definitions, or CDN and NAT.

Answer

Cloud VPC: Distributes incoming traffic across multiple instances

Answer

Cloud CDN: Network address translation for private instances to access internet

Question 7

Match each GCP security service to its function.

Accepted Answer

Cloud Armor: Protects against DDoS attacks and web application firewall. Cloud Armor protects against DDoS and web attacks; IAP controls access based on identity; KMS handles encryption keys; DLP protects sensitive data. Distractors swap these functions.

Answer

Cloud Armor: Manages encryption keys for cloud services

Answer

Cloud Identity-Aware Proxy (IAP): Scans for vulnerabilities in compute instances

Question 8

A multinational e-commerce company needs a globally distributed database that provides strong consistency and transactional support for order processing. Which Google Cloud database service should they use?

Accepted Answer

Cloud Spanner. Cloud Spanner is the correct choice because it is a globally distributed, horizontally scalable relational database service that provides strong consistency and full ACID transactional support across regions. Unlike other Google Cloud databases, Spanner uses synchronous replication and the TrueTime API to guarantee external consistency, making it ideal for order processing systems that require both global scale and transactional integrity.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 9

A data analytics company runs nightly batch jobs using Compute Engine instances. The jobs can tolerate interruptions, and the company wants to minimize costs. What should they do?

Accepted Answer

Use preemptible VMs for the batch jobs.. Preemptible VMs (now called Spot VMs) are Compute Engine instances that last up to 24 hours and can be terminated at any time by Google Cloud. Because the batch jobs are interruptible, using preemptible VMs reduces compute costs by up to 60-91% compared to standard on-demand VMs, directly meeting the goal of minimizing costs.

Answer

Use C2 high-CPU machine types for faster processing.

Answer

Use standard (on-demand) VMs and commit to a 1-year resource-based commitment.

Answer

Deploy VMs on Sole-tenant nodes for cost isolation.

Question 10

A financial services company is designing a multi-region application on Google Kubernetes Engine (GKE) for high availability. They need to serve user requests from the closest region and automatically failover if a region becomes unavailable. Which architecture should they use?

Accepted Answer

Deploy GKE clusters in multiple regions and use a multicluster ingress with an external HTTP(S) load balancer set up with the global external backend.. Deploying GKE clusters in multiple regions and using a multicluster ingress with a global external HTTP(S) load balancer enables traffic routing to the closest healthy backend cluster based on latency or geography, and automatically fails over to another region if one becomes unavailable. The global external backend configuration allows the load balancer to distribute traffic across multiple regional GKE clusters, providing both proximity-based routing and high availability.

Answer

Use a global external HTTP(S) load balancer with a single backend service pointing to one regional cluster.

Answer

Use Cloud CDN in front of a single regional GKE cluster to cache content.

Answer

Use a single regional GKE cluster with auto-scaling across zones.

Question 11

A media company wants to serve publicly available images and videos to a global audience with low latency. Which Google Cloud service should they primarily use?

Accepted Answer

Cloud CDN with Cloud Storage as the origin.. Cloud CDN with Cloud Storage as the origin is the correct choice because it uses Google's global edge cache to serve publicly available images and videos from Cloud Storage, minimizing latency for a global audience. Cloud CDN caches content at edge locations worldwide, reducing the round-trip time to the origin bucket, while Cloud Storage provides scalable, durable object storage. This combination is purpose-built for delivering static content with low latency and high throughput.

Answer

Cloud Storage with public bucket serving the files.

Answer

Cloud Run with a container that serves the files.

Answer

Compute Engine with an HTTP server.

Question 12

A company is migrating an on-premises PostgreSQL database to Cloud SQL with minimal downtime. The database is 1 TB and the network link has 500 Mbps bandwidth. Which migration approach is most appropriate?

Accepted Answer

Use Database Migration Service to perform continuous replication and then promote Cloud SQL.. Database Migration Service (DMS) supports continuous replication from on-premises PostgreSQL to Cloud SQL using native PostgreSQL logical replication (pglogical or native publication/slot). This allows near-zero downtime by keeping the target in sync until promotion, which is ideal for a 1 TB database over a 500 Mbps link where a full dump/restore would take hours.

Answer

Set up a Compute Engine instance with PostgreSQL replication and switch over.

Answer

Use BigQuery Data Transfer Service to replicate data.

Answer

Export the database as a SQL dump, transfer it to Cloud Storage, and import into Cloud SQL.

Question 13

An organization has multiple Google Cloud projects that need to access a shared Cloud SQL database. The database should only be accessible from authorized projects. What is the most secure way to grant access?

Accepted Answer

Configure the Cloud SQL instance with a private IP in a shared VPC and grant IAM roles to the authorized projects.. Using a private IP in a shared VPC ensures that Cloud SQL is not exposed to the public internet, and IAM roles (e.g., roles/cloudsql.client) allow fine-grained access control at the project level. This approach leverages VPC peering or shared VPC to restrict network access exclusively to authorized projects, eliminating the need for public IPs or complex VPN configurations while maintaining high security.

Answer

Use Cloud SQL Proxy on each project's Compute Engine instances.

Answer

Expose the Cloud SQL instance on a public IP and authorize the IP ranges of the projects.

Answer

Set up a Cloud VPN between each project's VPC and the VPC hosting Cloud SQL.

Question 14

A company is building a real-time data pipeline that ingests events from IoT devices, processes them with Apache Beam, and stores results in BigQuery for analytics. The pipeline must handle spikes in traffic and guarantee exactly-once processing. Which combination of services should they use?

Accepted Answer

Cloud Pub/Sub, Dataflow, and BigQuery.. Cloud Pub/Sub provides scalable, asynchronous ingestion for IoT event spikes, Dataflow (which runs Apache Beam) offers exactly-once processing semantics via checkpointing and idempotent sinks, and BigQuery serves as the analytics destination. This combination meets all requirements: Pub/Sub decouples producers from consumers, Dataflow handles stateful processing with exactly-once guarantees, and BigQuery supports real-time streaming inserts.

Answer

Cloud Pub/Sub, Dataproc, and BigQuery.

Answer

Cloud IoT Core, Data Fusion, and Cloud Bigtable.

Answer

Cloud Storage, Cloud Functions, and BigQuery.

Question 15

Which TWO statements are true regarding the benefits of using VPC Network Peering over Cloud VPN for connecting two VPC networks?

Accepted Answer

VPC Network Peering provides lower latency because traffic stays within Google's network.. VPC Network Peering uses Google's internal infrastructure to route traffic directly between VPC networks, avoiding the public internet and reducing the number of network hops. This results in lower latency compared to Cloud VPN, which typically encrypts and tunnels traffic over the public internet, introducing additional overhead and potential variability in latency.

Answer

VPC Network Peering requires a separate VPN gateway appliance.

Answer

VPC Network Peering can only be established within the same organization.

Answer

Cloud VPN encrypts traffic, which VPC Network Peering does not.