Google PCA Design and plan a cloud solution architecture Practice Test 3 — 15 Questions

Question 1

You need to store object data that is accessed infrequently (once a quarter) but must be retained for 10 years for compliance. Which storage class is the most cost-effective?

Accepted Answer

Archive. Archive storage class is the most cost-effective for data accessed once a quarter and retained for 10 years because it offers the lowest storage cost among Google Cloud Storage classes, designed for long-term preservation with retrieval times in minutes (typically under 15 minutes). The infrequent access pattern (once per quarter) aligns with Archive's trade-off of higher retrieval costs and minimum storage duration of 365 days, which is easily met by the 10-year retention requirement.

Answer

Standard

Answer

Nearline

Answer

Coldline

Question 2

A company is designing a multi-region architecture for disaster recovery. Their primary region is us-central1 and they want a warm standby in another region. The application runs on Compute Engine with a stateful backend. Which approach minimizes RTO while keeping costs reasonable?

Accepted Answer

Use a managed instance group in the secondary region with persistent disk snapshots and Cloud Load Balancing failover. Option B minimizes RTO by pre-provisioning Compute Engine instances in the secondary region via a managed instance group, using persistent disk snapshots for stateful data. This warm standby approach keeps instances ready to serve traffic with minimal startup delay, while Cloud Load Balancing failover automatically redirects traffic on primary region failure, balancing cost and recovery speed.

Answer

Use Cloud SQL cross-region replication and start Compute Engine instances on failover

Answer

Replicate the application to Cloud Run in the secondary region

Answer

Set up a managed instance group with instance templates in the secondary region without pre-provisioned instances

Question 3

A financial services company requires that all data stored in Cloud Storage be encrypted with keys they manage, rotate, and audit. They also need to enforce encryption at the bucket level. Which configuration should they use?

Accepted Answer

Use Cloud KMS with customer-managed encryption keys (CMEK). Option B is correct because customer-managed encryption keys (CMEK) with Cloud KMS allow the company to manage, rotate, and audit their own encryption keys while enforcing encryption at the bucket level. This meets the requirement of controlling key lifecycle and auditing, as Cloud KMS integrates with Cloud Audit Logs for key usage tracking.

Answer

Use default Google-managed encryption

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Enable CMEK at the bucket level with a Cloud KMS key

Question 4

A company hosts a web application on Compute Engine behind a global HTTP(S) load balancer. They notice that some users experience high latency from certain regions. They want to improve performance without adding complexity. What should they do?

Accepted Answer

Enable Cloud CDN. Option D is correct because enabling Cloud CDN caches content at Google's globally distributed edge caches, reducing latency for users in regions far from the origin Compute Engine instances. This directly addresses the high-latency issue without adding complexity, as it requires no changes to the application architecture and is a simple configuration toggle on the load balancer backend bucket or backend service.

Answer

Add more instances in the same region

Answer

Use Premium Tier networking

Answer

Enable Cloud Armor

Question 5

A company is migrating a monolithic application to Google Cloud. The application consists of a stateful service that writes to local disk and a stateless web server. They want to minimize changes to the code. Which architecture should they use?

Accepted Answer

Lift and shift to Compute Engine instances with persistent disks for stateful service. Option D is correct because it represents a lift-and-shift migration that minimizes code changes by running the monolithic application on Compute Engine instances. The stateful service can use persistent disks for local disk writes, while the stateless web server runs on the same or separate instances, preserving the existing architecture without refactoring.

Answer

Run the entire application on Cloud Run and use Cloud Filestore for shared state

Answer

Use App Engine Flexible Environment for the web server and Cloud SQL for state

Answer

Refactor the application into microservices and deploy on GKE with StatefulSets

Question 6

A company has a Cloud SQL for PostgreSQL instance with high read traffic. They want to offload read queries without modifying the application. Which strategy should they implement?

Accepted Answer

Create read replicas and configure the application to use them. Creating read replicas in Cloud SQL for PostgreSQL allows you to offload read traffic from the primary instance without modifying the application, because the replicas are fully managed and can serve read queries directly. The application can be configured to point to the read replica's endpoint, which handles SELECT statements while the primary continues to handle writes. This is the most direct and cost-effective solution for high read traffic when application changes are not permitted.

Answer

Increase the machine type of the primary instance

Answer

Implement a caching layer using Memorystore

Answer

Migrate to Cloud Spanner for better scalability

Question 7

A company is designing a VPC architecture for a multi-tenant SaaS platform. Each tenant has isolated workloads that must not communicate with each other. They also need centralized network security and logging. Which VPC design meets these requirements?

Accepted Answer

Use a Shared VPC with separate subnets for each tenant and firewall rules to enforce isolation. Option A is correct because Shared VPC with separate subnets per tenant and firewall rules for isolation provides centralized management. Option B is wrong because VPC peering requires explicit peering and does not provide isolation easily. Option C is wrong because Cloud VPN is not for multi-tenant isolation. Option D is wrong because a single VPC without subnets is insecure.

Answer

Dedicated Cloud VPN connections per tenant

Answer

Single VPC with network tags and IAP tunnels

Answer

Peered VPCs for each tenant with Cloud NAT

Question 8

Which TWO actions reduce egress costs when transferring data from Compute Engine to the internet? (Choose 2)

Accepted Answer

Use Cloud CDN to cache content. Options A and D are correct. Using a Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network does not reduce egress costs; it may increase. Compressing data reduces egress volume, but it's not always applicable and may affect latency. Moving to a different region does not reduce egress cost. There are only two correct: A and D. Actually, compressing data reduces the amount of data transferred, so that reduces egress cost. Let's reconsider. The correct answers: Using Cloud CDN (caches content, reduces origin egress) and using data compression (reduces size). Option A is correct, option D is correct. Option B (move to lower-cost region) does not reduce egress cost because egress is per GB, same worldwide. Option C (use Premium Tier) increases cost. Option E (use a NAT gateway) does not reduce egress.

Answer

Use Cloud NAT for outbound traffic

Answer

Move instances to a lower-cost region

Answer

Use Premium Tier networking

Question 9

Which THREE are best practices for designing a highly available Cloud SQL for MySQL instance? (Choose 3)

Accepted Answer

Enable automatic backups. Option B is correct because automatic backups in Cloud SQL for MySQL provide point-in-time recovery (PITR) capabilities, which are essential for data durability and disaster recovery. Enabling automatic backups ensures that transaction logs are retained, allowing you to restore your database to any point within the backup retention period, typically up to 7 days.

Answer

Configure cross-region replication

Answer

Set a maintenance window in off-peak hours

Question 10

A company wants to deploy a stateful application with strict low-latency requirements across multiple zones in a single region. They need to minimize inter-zone latency. Which THREE actions should they take? (Choose 3)

Accepted Answer

Place application instances in the same zone to minimize network hops. Option A is correct because placing all application instances in the same zone eliminates cross-zone network hops, which directly reduces inter-zone latency to near zero. For a stateful application with strict low-latency requirements, this co-location ensures that traffic between instances stays within a single failure domain, avoiding the additional latency introduced by traversing zone boundaries.

Answer

Deploy instances in a managed instance group across multiple zones

Answer

Use Dedicated Interconnect for on-premises connection

Question 11

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Accepted Answer

The service account lacks IAM permissions to read from Cloud Storage. Option A is correct because the scopes=cloud-platform grants all cloud API scopes, but authentication may fail if the service account does not have the proper IAM permissions (e.g., storage.objectViewer). Option B is wrong because pd-ssd is fine. Option C is wrong because the tags are for firewall rules, not storage access. Option D is wrong because the SA is specified.

Answer

The service account is not attached to the instance

Answer

The tags http-server and https-server block outbound traffic

Answer

The boot disk type is SSD, which is not compatible with Cloud Storage

Question 12

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Accepted Answer

The developer is assigned only the objectViewer role. Option C is correct because the developer only has roles/storage.objectViewer (read-only), not write access. Option A is wrong because there is no explicit deny. Option B is wrong because the service account has admin, but that doesn't affect the user. Option D is wrong because the user is included.

Answer

An organization policy denies all write operations

Answer

The developer is not a member of the project

Answer

The service account my-sa overrides the developer's permissions

Question 13

A company is migrating a critical on-premises application to Google Cloud. The application consists of a frontend web server that handles user requests and a backend database server that stores session state and processed data. The application is stateful because session data is stored in memory on the backend server. The company wants to minimize downtime during migration and ensure that the application can scale horizontally in the future. The current on-premises architecture has the web server and database server on separate physical machines. The web server communicates with the database server via a private network. The company expects that after migration, the application will need to handle double the current traffic. They also need to ensure that the architecture is resilient to zone failures within a single region. They are considering using Compute Engine for both the web and database servers, but they are open to other Google Cloud services. They have a requirement that the database must be relational and support ACID transactions. The database currently uses Microsoft SQL Server, but they are willing to migrate to a different database engine if it reduces operational overhead and provides better scalability. The team has limited experience with Google Cloud and wants to minimize architectural changes. Which course of action should the company take?

Accepted Answer

Migrate the web server to Compute Engine with a managed instance group and internal load balancer. Migrate the database to Cloud SQL for SQL Server with high availability across zones.. Option C is correct because it preserves the existing stateful architecture by using Compute Engine with a managed instance group and internal load balancer for the web tier, and Cloud SQL for SQL Server with cross-zone high availability for the database. This minimizes architectural changes, supports horizontal scaling via the managed instance group, and provides zone-level resilience for the relational database with ACID transactions, meeting the requirement to handle double traffic while minimizing downtime.

Answer

Refactor the application to be stateless. Migrate the web server to App Engine and the database to Cloud SQL for PostgreSQL. Use Cloud Memorystore for session state.

Answer

Migrate the web server to Compute Engine and the database to Cloud Spanner. Use a global load balancer for the web server and Spanner for transactional consistency.

Answer

Lift and shift both web and database servers to Compute Engine. Use a managed instance group with autoscaling for the web server and a standalone VM for the database. Configure persistent disks for data.

Question 14

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Accepted Answer

Deployment with pod anti-affinity rules spread across zones. Option C is correct because Deployments support rolling updates and pod anti-affinity can spread pods across zones for high availability. StatefulSets are for stateful workloads, DaemonSets for node-level daemons, and Jobs for batch tasks.

Answer

StatefulSet with volumeClaimTemplates for persistent storage

Answer

Job for batch processing

Answer

DaemonSet to ensure one pod per node

Question 15

A company is planning a hybrid cloud architecture using Anthos to manage workloads across on-premises data centers and Google Cloud. They need to select two key components that enable consistent configuration, policy, and security across environments. Which two should they choose?

Accepted Answer

GKE on-prem. GKE on-prem (now Anthos clusters on bare metal or VMware) is correct because it provides a consistent Kubernetes platform that runs on-premises, enabling the same container orchestration, policy enforcement, and security controls as GKE in Google Cloud. Config Sync is correct because it continuously reconciles the desired state of cluster configurations from a Git repository, ensuring that policies, RBAC, and security settings remain identical across all Anthos clusters, whether on-prem or in the cloud.

Answer

Cloud Interconnect

Answer

Cloud Build

Answer

Cloud Load Balancing