Google PCA Design and plan a cloud solution architecture Practice Test 4 — 15 Questions

Question 1

A company is migrating a critical on-premises application to Google Cloud. The application consists of a frontend web server that handles user requests and a backend database server that stores session state and processed data. The application is stateful because session data is stored in memory on the backend server. The company wants to minimize downtime during migration and ensure that the application can scale horizontally in the future. The current on-premises architecture has the web server and database server on separate physical machines. The web server communicates with the database server via a private network. The company expects that after migration, the application will need to handle double the current traffic. They also need to ensure that the architecture is resilient to zone failures within a single region. They are considering using Compute Engine for both the web and database servers, but they are open to other Google Cloud services. They have a requirement that the database must be relational and support ACID transactions. The database currently uses Microsoft SQL Server, but they are willing to migrate to a different database engine if it reduces operational overhead and provides better scalability. The team has limited experience with Google Cloud and wants to minimize architectural changes. Which course of action should the company take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Migrate the web server to Compute Engine with a managed instance group and internal load balancer. Migrate the database to Cloud SQL for SQL Server with high availability across zones.. It preserves the existing stateful architecture by using Compute Engine with a managed instance group and internal load balancer for the web tier, and Cloud SQL for SQL Server with cross-zone high availability for the database. This minimizes architectural changes, supports horizontal scaling via the managed instance group, and provides zone-level resilience for the relational database with ACID transactions, meeting the requirement to handle double traffic while minimizing downtime.

Answer

Refactor the application to be stateless. Migrate the web server to App Engine and the database to Cloud SQL for PostgreSQL. Use Cloud Memorystore for session state.

Answer

Migrate the web server to Compute Engine and the database to Cloud Spanner. Use a global load balancer for the web server and Spanner for transactional consistency.

Answer

Lift and shift both web and database servers to Compute Engine. Use a managed instance group with autoscaling for the web server and a standalone VM for the database. Configure persistent disks for data.

Question 2

A company is planning a hybrid cloud architecture using Anthos to manage workloads across on-premises data centers and Google Cloud. They need to select two key components that enable consistent configuration, policy, and security across environments. Which two should they choose?

Accepted Answer

GKE on-prem. GKE on-prem (now Anthos clusters on bare metal or VMware) is correct because it provides a consistent Kubernetes platform that runs on-premises, enabling the same container orchestration, policy enforcement, and security controls as GKE in Google Cloud. Config Sync is correct because it continuously reconciles the desired state of cluster configurations from a Git repository, ensuring that policies, RBAC, and security settings remain identical across all Anthos clusters, whether on-prem or in the cloud.

Answer

Cloud Interconnect

Answer

Cloud Build

Answer

Cloud Load Balancing

Question 3

A company runs a multi-tier web application on Google Kubernetes Engine (GKE) with a frontend service, a backend service, and a Cloud SQL for PostgreSQL database. During peak hours, the frontend pod CPU usage is high (consistently above 80%), while the backend service shows moderate CPU usage (around 50%). Response times for user requests increase significantly, often exceeding the 200ms p99 latency target. Cloud SQL metrics show low query latency and no contention. The team wants to improve performance in a cost-effective manner. Which initial step should they take?

Accepted Answer

Increase the number of frontend pods by adjusting the horizontal pod autoscaler's target CPU utilization.. The frontend pods are CPU-bound during peak hours, causing increased response times. Increasing the number of frontend pods via the Horizontal Pod Autoscaler (HPA) by lowering the target CPU utilization threshold distributes the load across more replicas, directly addressing the bottleneck without additional infrastructure cost. This is the most cost-effective initial step because it leverages existing resources and autoscaling capabilities.

Answer

Add a read replica for Cloud SQL to offload read queries.

Answer

Migrate the backend service to a custom machine type with more vCPUs.

Answer

Enable vertical pod autoscaling for the backend service.

Question 4

Refer to the exhibit. A user alice@example.com is unable to list objects in bucket 'bucket-b'. What is the most likely reason?

Accepted Answer

The condition restricts access only to bucket-a.. The IAM policy condition explicitly restricts access to resources with a name matching 'bucket-a'. Since the user is trying to list objects in 'bucket-b', the condition evaluates to false, and the IAM policy does not grant the required permissions. Without a matching condition, the effective permission set is empty, causing the list operation to fail.

Answer

The IAM policy is missing the roles/storage.objectAdmin role.

Answer

The condition expression is invalid.

Answer

The user needs the roles/storage.legacyBucketReader role.

Question 5

A company is migrating a legacy on-premises application to Google Cloud. The application has strict low-latency requirements between its components and requires stateful TCP sessions. Which TWO design decisions should the architect recommend?

Accepted Answer

Use regional managed instance groups with internal load balancing.. Regional managed instance groups (MIGs) with internal load balancing are correct because they keep all compute instances within a single region, minimizing network hops and latency between components. Internal load balancing provides a single IP address for stateful TCP sessions without introducing the latency of a global proxy, and it supports session affinity (e.g., client IP affinity) to maintain stateful connections.

Answer

Use Cloud NAT for outbound connectivity.

Answer

Use global load balancing with Cloud CDN.

Answer

Use Cloud VPN for on-premises connectivity.

Question 6

A company runs a web application on Compute Engine instances behind a global HTTP(S) Load Balancer. The application uses Cloud SQL for MySQL for user data. Users report that during peak hours, the page load times increase significantly. The development team notices that the number of database connections exceeds the maximum allowed, causing some requests to fail. The application is designed to use connection pooling with a maximum pool size of 100 connections per instance. There are currently 10 instances. The Cloud SQL instance is configured with 4 vCPUs and 15 GB memory, and the maximum connections is set to 400. The application team wants to minimize cost while resolving the issue. What should the architect recommend?

Accepted Answer

Reduce the max pool size per instance to 40 connections.. With 10 instances each configured for a max pool size of 100, the total potential connections is 1000, far exceeding the Cloud SQL limit of 400. Reducing the pool size to 40 per instance brings the total to exactly 400, fitting within the limit without any additional cost. Option B increases the instance tier, which adds cost unnecessarily when the current tier is sufficient with proper connection sizing. Option C is not feasible because load balancers do not manage database connection pooling. Option D does not reduce the total number of connections and adds complexity without solving the core issue.

Answer

Increase the Cloud SQL instance tier to have more vCPUs and memory.

Answer

Implement connection pooling at the global HTTP(S) Load Balancer level.

Answer

Use Cloud SQL Proxy with connection pooling.

Question 7

Refer to the exhibit. A user creates a snapshot of a persistent disk. Later, they want to create a new VM from this snapshot in the same project but in a different region (europe-west1). Which step is missing or incorrect?

Accepted Answer

The user must wait for the snapshot operation to complete before using it to create a VM.. A snapshot operation is asynchronous; the snapshot must reach the 'READY' state before it can be used to create a VM. Attempting to create a VM from a snapshot that is still being created will fail, as the snapshot data is not yet fully available.

Answer

The snapshot cannot be used to create a VM in a different region; the user must first create a disk in the same region and then replicate it.

Answer

The snapshot must be created with '--storage-location=europe-west1' to be usable in that region.

Answer

The user must specify the '--region' flag when creating the snapshot to make it available in europe-west1.

Question 8

Refer to the exhibit. A security team wants to ensure that the service account 'sa-compute' can only be used by the instance admin role. Currently, any user with 'iam.serviceAccountUser' on the project can impersonate it. Which change should be made to the policy?

Accepted Answer

Remove the 'roles/iam.serviceAccountUser' binding from the project policy and add a resource-level policy on the service account granting 'roles/iam.serviceAccountUser' only to 'developer@example.com'.. The exhibit shows a project-level IAM policy. The service account 'sa-compute' is granted 'roles/iam.serviceAccountUser' at the project level, meaning any user with that role on the project can impersonate it. To restrict usage, the policy should grant 'roles/iam.serviceAccountUser' on the service account itself to only specific users, not at the project level. The correct approach is to remove the project-level binding and add a resource-level policy on the service account.

Answer

Add a condition to the 'roles/iam.serviceAccountUser' binding that restricts access to only the instance admin.

Answer

Modify the project policy to change the 'roles/iam.serviceAccountUser' member to 'user:developer@example.com'.

Answer

Create a new custom role that combines 'roles/compute.instanceAdmin.v1' and 'roles/iam.serviceAccountUser' and assign it to 'developer@example.com'.

Question 9

Refer to the exhibit. An engineer deploys this Terraform configuration. After deployment, they can SSH into the VM using its public IP. However, they want to restrict SSH access to only a specific IP range (203.0.113.0/24). What change is required?

Accepted Answer

Change the 'source_ranges' in the firewall rule to ['203.0.113.0/24']. The instance already has the required tag.. The firewall rule 'allow-ssh' currently allows SSH from all IPs (0.0.0.0/0) to instances with tag 'ssh-allowed'. To restrict to a specific IP range, the source_ranges must be updated to ['203.0.113.0/24']. The instance already has the tag 'ssh-allowed', so no change to tags is needed.

Answer

Modify the instance to use a network tag 'restricted-ssh' and update the firewall rule target_tags accordingly.

Answer

Add a new firewall rule with higher priority allowing SSH from 203.0.113.0/24, and keep the existing rule but change its priority to 100.

Answer

Update the 'source_ranges' in the firewall rule to ['203.0.113.0/24'] and remove the 'ssh-allowed' tag from the instance.

Question 10

Refer to the exhibit. All five nginx pods are scheduled on the same node (default-pool-1). What is the most likely reason?

Accepted Answer

The other nodes have taints that the pods do not tolerate.. Taints on nodes prevent pods from being scheduled unless the pods have corresponding tolerations. If the other nodes have taints that the nginx pods do not tolerate, the scheduler will only place them on nodes without those taints, which in this case is default-pool-1. This is a common scenario when nodes are dedicated to specific workloads or have special hardware.

Answer

The node auto-scaler has not created additional nodes yet, but the other nodes are present.

Answer

The pods have a nodeSelector that matches only default-pool-1.

Answer

The resource requests are too high, so the scheduler packed pods onto one node due to resource constraints on the others.

Question 11

Refer to the exhibit. A user creates a Cloud SQL for PostgreSQL instance and a Compute Engine VM. The VM cannot connect to the database. What is the most likely cause?

Accepted Answer

The Cloud SQL instance does not have a private IP assigned, but the VM is attempting to connect using the private IP.. The Cloud SQL instance has authorized networks set to 0.0.0.0/0, which allows all IPs. However, the instance has a public IP, and the VM has an external IP. The connection fails with timeout, suggesting that the traffic is not reaching the database. This could be due to the database not having SSL enforced, but that would cause a different error. The most likely cause is that the Cloud SQL instance is not configured to allow connections from the VM's public IP, because authorized networks only apply to connections using the public IP. But the exhibit shows it's set to 0.0.0.0/0, so that should work. Another possibility: the VM is trying to connect to the private IP of the Cloud SQL instance, but the instance does not have a private IP. The exhibit shows '--assign-ip' which assigns a public IP, but does not assign a private IP. The VM might be trying to connect to the private IP, which doesn't exist. However, the error is 'connection timed out', which suggests the client cannot reach the IP. If the client is using the public IP, the firewall on the VM allows egress. The issue could be that the Cloud SQL instance's public IP is not reachable from the VM's network due to VPC firewall rules? But the VM's firewall allows egress to 0.0.0.0/0. The most likely cause is that the Cloud SQL instance does not have a private IP, and the VM is trying to connect via private IP. But the user might be using the correct public IP. Another common issue: the Cloud SQL instance requires SSL, but the client is not using SSL. However, that would give a different error like 'SSL required'. The timeout suggests network connectivity. Given the exhibit, the Cloud SQL instance has only a public IP and authorized networks allow all IPs, so the issue is likely that the VM is trying to connect using the instance's private IP, which doesn't exist. Alternatively, the VM might be in a different VPC and peering is not set up. But the question says 'different VPC'. Since the instance has a public IP, the VM can connect via public IP regardless of VPC. The most plausible answer is that the Cloud SQL instance does not have a private IP, and the user is trying to connect to the private IP. However, the exhibit doesn't show the connection string. Another possibility: the user has not enabled public IP access from the VM's network? No, authorized networks allow all. I think the intended answer is that the Cloud SQL instance does not have a private IP, so the VM, if using private IP, cannot connect. But the question says 'connection fails', so we need to infer. Let me craft options.

Answer

The Cloud SQL instance requires SSL connections, and the client is not using SSL.

Answer

The VM's firewall is blocking egress to port 5432 on the Cloud SQL public IP.

Answer

The authorized networks setting is too permissive; it should be restricted to the VM's public IP.

Question 12

Refer to the exhibit. An engineer deployed this Terraform configuration and can SSH to the instance using the external IP. However, they notice that the instance has a public IP address even though they intended to have no public IP. What change should be made to the configuration to ensure the instance does not get a public IP?

Accepted Answer

Remove the entire access_config block from the network_interface configuration.. The `access_config` block in a Terraform `google_compute_instance` resource is what assigns a public (external) IP address to the instance's network interface. By removing the entire `access_config` block, the instance will only receive a private IP address, fulfilling the requirement of no public IP. Leaving the block empty (as in option C) still creates an ephemeral external IP by default, so it does not solve the problem.

Answer

Change the metadata key enable-oslogin to FALSE.

Answer

Set access_config = [] instead of leaving it empty.

Answer

Set the network to a custom VPC that does not have external internet access.

Question 13

Refer to the exhibit. A developer is trying to connect to the Kubernetes API server from their workstation using the master IP (34.67.89.12) but receives a timeout. The developer can reach other external IPs. What is the most likely reason for the timeout?

Accepted Answer

The private cluster is configured with a private endpoint and public endpoint disabled, so the master IP is not accessible from outside the VPC.. A private GKE cluster with a private endpoint and public endpoint disabled means the Kubernetes API server is only reachable from within the cluster's VPC network. The developer's workstation is outside the VPC, so attempts to reach the master IP (34.67.89.12) will time out, even though other external IPs are reachable. This is a common configuration for security-sensitive workloads that require the API server to be isolated from the public internet.

Answer

The cluster is in a different region than the developer's VPC.

Answer

The developer's workstation does not have the required firewall rule to allow traffic to the master IP.

Answer

The Kubernetes Engine API is not enabled in the developer's project.

Question 14

Refer to the exhibit. An engineer is reviewing health check logs for a target pool. The instance web-01 is still serving traffic despite two consecutive unhealthy health checks. Why is the instance not removed from the target pool?

Accepted Answer

The instance was removed after the second failure but then re-added after the next healthy check, so it is serving traffic again.. The instance was removed from the target pool after the second consecutive unhealthy health check, but it was immediately re-added after the next healthy health check. This happens when the health check's `unhealthyThreshold` is set to 2, meaning two consecutive failures trigger removal, but the instance then passes a subsequent health check, causing it to be re-added and resume serving traffic. The logs show the instance is still serving traffic because it was removed and then re-added within the same monitoring window.

Answer

The health check's timeoutSec is too high, causing delayed removal.

Answer

The forwarding rule is not using the target pool, so health checks have no effect.

Answer

The healthyThreshold is set to 2, requiring two healthy checks before re-adding, but the instance only had one healthy check.

Question 15

Refer to the exhibit. An engineer created an instance with a startup script that references a Cloud Storage bucket. The instance boots but the startup script fails. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket 'my-bucket' does not exist or the object 'startup.sh' is missing.. The error message indicates that the startup script cannot find the resource at gs://my-bucket/startup.sh. This could be because the bucket does not exist, the object does not exist, or the instance does not have permission to access the bucket. Given that the bucket is named 'my-bucket', it's likely that the bucket does not exist or the name is incorrect.

Answer

The startup script is not executable.

Answer

The instance does not have the appropriate IAM permissions to read from Cloud Storage.

Answer

The instance has no network connectivity to access Cloud Storage.