Google PCA Design and plan a cloud solution architecture Practice Test 3 — 15 Questions

Question 1

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the health check path specified in the backend service returns a 200 OK status.. The HTTP(S) load balancer's health check probes the specified path on each backend instance. If the path does not return a 200 OK status, the load balancer marks the instance as unhealthy and stops sending traffic to it. Ensuring the health check path returns a 200 OK is the first step in verifying that the health check is configured correctly.

Answer

Disable session affinity to allow better distribution of traffic.

Answer

Change the health check interval from 5 seconds to 30 seconds.

Answer

Increase the number of instances in the instance group to distribute the load.

Question 2

Which THREE practices are recommended for organizing projects in a Google Cloud organization?

Accepted Answer

Use a separate project for each environment (e.g., development, staging, production).. Using separate projects for each environment (development, staging, production) enforces resource isolation, prevents accidental cross-environment changes, and allows independent IAM policies, billing, and quotas. This aligns with Google Cloud's recommended resource hierarchy best practices for managing lifecycle and security boundaries.

Answer

Create a separate project to hold organization policies.

Answer

Consolidate all production resources into a single project for simplicity.

Question 3

Refer to the exhibit. What is the primary benefit of the `--preemptible` flag in this command?

Accepted Answer

Significant cost reduction compared to standard instances.. The `--preemptible` flag in Google Cloud Platform (GCP) creates preemptible VM instances, which are short-lived, cost-effective instances that can be terminated at any time by GCP. The primary benefit is a significant cost reduction—up to 60-91% lower than standard instances—making them ideal for batch jobs, fault-tolerant workloads, and non-critical tasks. This flag does not affect startup time, availability guarantees, or provide free access to specialized hardware.

Answer

Faster instance startup time due to optimized kernel.

Answer

Higher availability through automatic restart on failure.

Answer

Access to specialized hardware like GPUs at no extra cost.

Question 4

Refer to the exhibit. A Cloud Storage bucket has this IAM policy. What security recommendation should be made?

Accepted Answer

Remove the `allUsers` member and use signed URLs for public access.. The IAM policy grants `roles/storage.objectViewer` to `allUsers`, which makes the bucket's objects publicly readable by anyone on the internet. This is a security risk because it allows anonymous access without authentication or logging. The recommended practice is to remove the `allUsers` member and instead use signed URLs (which embed a time-limited access token) to grant temporary, controlled access to specific objects.

Answer

Change `allUsers` to `allAuthenticatedUsers` to allow only authenticated users.

Answer

Enable uniform bucket-level access and update the IAM policy.

Answer

Remove the `roles/storage.objectViewer` role binding entirely.

Question 5

Refer to the exhibit. A subnet was created with the `--enable-private-ip-google-access` flag. What does this flag enable for instances in this subnet?

Accepted Answer

Instances can access Google APIs and services without requiring an external IP address.. The `--enable-private-ip-google-access` flag allows VM instances in a subnet to reach Google APIs and services (such as Cloud Storage, BigQuery, and Cloud Pub/Sub) using only their internal (private) IP addresses, without needing an external IP address. This works by routing traffic through Google's internal network to the Google Front End (GFE), bypassing the public internet.

Answer

Instances can use direct peering to connect to on-premises networks.

Answer

Instances automatically receive internal DNS names for Google services.

Answer

Instances can route traffic to the internet through a Cloud NAT gateway.

Question 6

A startup is building a web application that experiences unpredictable traffic spikes. They want a scalable solution that minimizes costs. Which Google Cloud service should they use to run their containerized application?

Accepted Answer

Google Kubernetes Engine (GKE) with autoscaling. Google Kubernetes Engine (GKE) with autoscaling is the correct choice because it combines cluster autoscaling (which adjusts the number of nodes based on pod resource requests) with Horizontal Pod Autoscaling (which scales the number of pod replicas based on CPU/memory utilization or custom metrics). This dual-layer scaling handles unpredictable traffic spikes efficiently while minimizing costs by only provisioning resources when needed, and it is purpose-built for containerized applications.

Answer

App Engine Standard Environment

Answer

Cloud Run for Anthos

Answer

Compute Engine with managed instance groups

Question 7

A company is migrating to Google Cloud and needs to connect their on-premises network to a VPC. They require high bandwidth and a reliable connection with a Service Level Agreement (SLA). Which solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google's network, offering high bandwidth (10 or 100 Gbps per link) and a 99.99% uptime SLA when configured with redundant links. This meets the requirements for high bandwidth and a reliable, SLA-backed connection better than any other option.

Answer

Cloud VPN with dynamic routing

Answer

Partner Interconnect via a service provider

Answer

Direct Peering

Question 8

A company is designing a multi-region architecture for disaster recovery. Their primary region is us-central1 and they want a warm standby in another region. The application runs on Compute Engine with a stateful backend. Which approach minimizes RTO while keeping costs reasonable?

Accepted Answer

Use a managed instance group in the secondary region with persistent disk snapshots and Cloud Load Balancing failover. Minimizes RTO by pre-provisioning Compute Engine instances in the secondary region via a managed instance group, using persistent disk snapshots for stateful data. This warm standby approach keeps instances ready to serve traffic with minimal startup delay, while Cloud Load Balancing failover automatically redirects traffic on primary region failure, balancing cost and recovery speed.

Answer

Use Cloud SQL cross-region replication and start Compute Engine instances on failover

Answer

Replicate the application to Cloud Run in the secondary region

Answer

Set up a managed instance group with instance templates in the secondary region without pre-provisioned instances

Question 9

A financial services company requires that all data stored in Cloud Storage be encrypted with keys they manage, rotate, and audit. They also need to enforce encryption at the bucket level. Which configuration should they use?

Accepted Answer

Use Cloud KMS with customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) with Cloud KMS allow the company to manage, rotate, and audit their own encryption keys while enforcing encryption at the bucket level. This meets the requirement of controlling key lifecycle and auditing, as Cloud KMS integrates with Cloud Audit Logs for key usage tracking.

Answer

Use default Google-managed encryption

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Enable CMEK at the bucket level with a Cloud KMS key

Question 10

A company hosts a web application on Compute Engine behind a global HTTP(S) load balancer. They notice that some users experience high latency from certain regions. They want to improve performance without adding complexity. What should they do?

Accepted Answer

Enable Cloud CDN. Enabling Cloud CDN caches content at Google's globally distributed edge caches, reducing latency for users in regions far from the origin Compute Engine instances. This directly addresses the high-latency issue without adding complexity, as it requires no changes to the application architecture and is a simple configuration toggle on the load balancer backend bucket or backend service.

Answer

Add more instances in the same region

Answer

Use Premium Tier networking

Answer

Enable Cloud Armor

Question 11

A company is migrating a monolithic application to Google Cloud. The application consists of a stateful service that writes to local disk and a stateless web server. They want to minimize changes to the code. Which architecture should they use?

Accepted Answer

Lift and shift to Compute Engine instances with persistent disks for stateful service. It represents a lift-and-shift migration that minimizes code changes by running the monolithic application on Compute Engine instances. The stateful service can use persistent disks for local disk writes, while the stateless web server runs on the same or separate instances, preserving the existing architecture without refactoring.

Answer

Run the entire application on Cloud Run and use Cloud Filestore for shared state

Answer

Use App Engine Flexible Environment for the web server and Cloud SQL for state

Answer

Refactor the application into microservices and deploy on GKE with StatefulSets

Question 12

A company has a Cloud SQL for PostgreSQL instance with high read traffic. They want to offload read queries without modifying the application. Which strategy should they implement?

Accepted Answer

Create read replicas and configure the application to use them. Creating read replicas in Cloud SQL for PostgreSQL allows you to offload read traffic from the primary instance without modifying the application, because the replicas are fully managed and can serve read queries directly. The application can be configured to point to the read replica's endpoint, which handles SELECT statements while the primary continues to handle writes. This is the most direct and cost-effective solution for high read traffic when application changes are not permitted.

Answer

Increase the machine type of the primary instance

Answer

Implement a caching layer using Memorystore

Answer

Migrate to Cloud Spanner for better scalability

Question 13

Which TWO actions reduce egress costs when transferring data from Compute Engine to the internet? (Choose 2)

Accepted Answer

Use Cloud CDN to cache content. Cloud CDN caches content at edge locations, reducing the amount of data served from the origin Compute Engine instance, thus lowering egress costs. Compressing data before transfer reduces the volume of data sent, directly decreasing egress costs. Cloud NAT does not affect egress costs; it only provides outbound connectivity. Moving instances to a lower-cost region does not reduce egress costs because egress pricing is similar across regions. Premium Tier networking typically increases costs due to higher per-GB charges.

Answer

Use Cloud NAT for outbound traffic

Answer

Move instances to a lower-cost region

Answer

Use Premium Tier networking

Question 14

Which THREE are best practices for designing a highly available Cloud SQL for MySQL instance? (Choose 3)

Accepted Answer

Enable automatic backups. Automatic backups in Cloud SQL for MySQL provide point-in-time recovery (PITR) capabilities, which are essential for data durability and disaster recovery. Enabling automatic backups ensures that transaction logs are retained, allowing you to restore your database to any point within the backup retention period, typically up to 7 days.

Answer

Configure cross-region replication

Answer

Set a maintenance window in off-peak hours

Question 15

A company wants to deploy a stateful application with strict low-latency requirements across multiple zones in a single region. They need to minimize inter-zone latency. Which THREE actions should they take? (Choose 3)

Accepted Answer

Place application instances in the same zone to minimize network hops. Placing all application instances in the same zone eliminates cross-zone network hops, which directly reduces inter-zone latency to near zero. For a stateful application with strict low-latency requirements, this co-location ensures that traffic between instances stays within a single failure domain, avoiding the additional latency introduced by traversing zone boundaries.

Answer

Deploy instances in a managed instance group across multiple zones

Answer

Use Dedicated Interconnect for on-premises connection