Google PCA Design and plan a cloud solution architecture Practice Test 5 — 15 Questions

Question 1

A financial services company is designing a multi-region application on Google Kubernetes Engine (GKE) for high availability. They need to serve user requests from the closest region and automatically failover if a region becomes unavailable. Which architecture should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy GKE clusters in multiple regions and use a multicluster ingress with an external HTTP(S) load balancer set up with the global external backend.. Deploying GKE clusters in multiple regions and using a multicluster ingress with a global external HTTP(S) load balancer enables traffic routing to the closest healthy backend cluster based on latency or geography, and automatically fails over to another region if one becomes unavailable. The global external backend configuration allows the load balancer to distribute traffic across multiple regional GKE clusters, providing both proximity-based routing and high availability.

Answer

Use a global external HTTP(S) load balancer with a single backend service pointing to one regional cluster.

Answer

Use Cloud CDN in front of a single regional GKE cluster to cache content.

Answer

Use a single regional GKE cluster with auto-scaling across zones.

Question 2

A media company wants to serve publicly available images and videos to a global audience with low latency. Which Google Cloud service should they primarily use?

Accepted Answer

Cloud CDN with Cloud Storage as the origin.. Cloud CDN with Cloud Storage as the origin is the correct choice because it uses Google's global edge cache to serve publicly available images and videos from Cloud Storage, minimizing latency for a global audience. Cloud CDN caches content at edge locations worldwide, reducing the round-trip time to the origin bucket, while Cloud Storage provides scalable, durable object storage. This combination is purpose-built for delivering static content with low latency and high throughput.

Answer

Cloud Storage with public bucket serving the files.

Answer

Cloud Run with a container that serves the files.

Answer

Compute Engine with an HTTP server.

Question 3

A company is migrating an on-premises PostgreSQL database to Cloud SQL with minimal downtime. The database is 1 TB and the network link has 500 Mbps bandwidth. Which migration approach is most appropriate?

Accepted Answer

Use Database Migration Service to perform continuous replication and then promote Cloud SQL.. Database Migration Service (DMS) supports continuous replication from on-premises PostgreSQL to Cloud SQL using native PostgreSQL logical replication (pglogical or native publication/slot). This allows near-zero downtime by keeping the target in sync until promotion, which is ideal for a 1 TB database over a 500 Mbps link where a full dump/restore would take hours.

Answer

Set up a Compute Engine instance with PostgreSQL replication and switch over.

Answer

Use BigQuery Data Transfer Service to replicate data.

Answer

Export the database as a SQL dump, transfer it to Cloud Storage, and import into Cloud SQL.

Question 4

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

Accepted Answer

Cloud Run (fully managed).. Cloud Run (fully managed) is the right choice because it runs containerized applications on a fully managed serverless platform that automatically scales instances up and down (including to zero) based on traffic, and it bills only for the CPU, memory, and request resources actually consumed. This matches the startup's needs: containers, automatic scaling, pay-per-use pricing, and minimal operational overhead since Google manages the underlying infrastructure. App Engine Standard with a custom runtime is more restrictive and less container-native, while GKE with a multi-node pool and Compute Engine with a managed instance group both require the team to manage clusters, nodes, or instances and typically incur costs for provisioned capacity even when idle, which does not fit a low-ops, usage-based model.

Answer

App Engine Standard Environment with a custom runtime.

Answer

Google Kubernetes Engine (GKE) with a multi-node pool.

Answer

Compute Engine with a managed instance group.

Question 5

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Ensure the health check path specified in the backend service returns a 200 OK status.. Option A is correct because the health check probe only marks an instance healthy when the configured request path returns an HTTP 200 OK response; if the path returns 404, 500, or a redirect, the instance will be flagged unhealthy, so verifying the path is a primary troubleshooting step. Option B is correct because Google Cloud external HTTP(S) load balancer health checks originate from specific Google health check source IP ranges (e.g., 35.191.0.0/16 and 130.211.0.0/22), and firewall rules must permit ingress from these ranges to the instances on the health check port, otherwise probes are dropped and instances fail. Option C is not relevant because session affinity affects how client traffic is routed, not whether health check probes succeed. Option D is not a fix because lengthening the interval only delays detection and does not resolve the underlying cause of failed probes. Option E is not appropriate because adding instances does not correct failing health checks and may simply add more unhealthy instances.

Answer

Disable session affinity to allow better distribution of traffic.

Answer

Change the health check interval from 5 seconds to 30 seconds.

Answer

Increase the number of instances in the instance group to distribute the load.

Question 6

Which THREE practices are recommended for organizing projects in a Google Cloud organization?

Accepted Answer

Use a separate project for each environment (e.g., development, staging, production).. Using separate projects for each environment (development, staging, production) enforces resource isolation, prevents accidental cross-environment changes, and allows independent IAM policies, billing, and quotas. This aligns with Google Cloud's recommended resource hierarchy best practices for managing lifecycle and security boundaries.

Answer

Create a separate project to hold organization policies.

Answer

Consolidate all production resources into a single project for simplicity.

Question 7

Refer to the exhibit. What is the primary benefit of the `--preemptible` flag in this command?

Accepted Answer

Significant cost reduction compared to standard instances.. The `--preemptible` flag in Google Cloud Platform (GCP) creates preemptible VM instances, which are short-lived, cost-effective instances that can be terminated at any time by GCP. The primary benefit is a significant cost reduction—up to 60-91% lower than standard instances—making them ideal for batch jobs, fault-tolerant workloads, and non-critical tasks. This flag does not affect startup time, availability guarantees, or provide free access to specialized hardware.

Answer

Faster instance startup time due to optimized kernel.

Answer

Higher availability through automatic restart on failure.

Answer

Access to specialized hardware like GPUs at no extra cost.

Question 8

Refer to the exhibit. A Cloud Storage bucket has this IAM policy. What security recommendation should be made?

Accepted Answer

Remove the `allUsers` member and use signed URLs for public access.. The IAM policy grants `roles/storage.objectViewer` to `allUsers`, which makes the bucket's objects publicly readable by anyone on the internet. This is a security risk because it allows anonymous access without authentication or logging. The recommended practice is to remove the `allUsers` member and instead use signed URLs (which embed a time-limited access token) to grant temporary, controlled access to specific objects.

Answer

Change `allUsers` to `allAuthenticatedUsers` to allow only authenticated users.

Answer

Enable uniform bucket-level access and update the IAM policy.

Answer

Remove the `roles/storage.objectViewer` role binding entirely.

Question 9

Refer to the exhibit. A subnet was created with the `--enable-private-ip-google-access` flag. What does this flag enable for instances in this subnet?

Accepted Answer

Instances can access Google APIs and services without requiring an external IP address.. The `--enable-private-ip-google-access` flag allows VM instances in a subnet to reach Google APIs and services (such as Cloud Storage, BigQuery, and Cloud Pub/Sub) using only their internal (private) IP addresses, without needing an external IP address. This works by routing traffic through Google's internal network to the Google Front End (GFE), bypassing the public internet.

Answer

Instances can use direct peering to connect to on-premises networks.

Answer

Instances automatically receive internal DNS names for Google services.

Answer

Instances can route traffic to the internet through a Cloud NAT gateway.

Question 10

A company is migrating to Google Cloud and needs to connect their on-premises network to a VPC. They require high bandwidth and a reliable connection with a Service Level Agreement (SLA). Which solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google's network, offering high bandwidth (10 or 100 Gbps per link) and a 99.99% uptime SLA when configured with redundant links. This meets the requirements for high bandwidth and a reliable, SLA-backed connection better than any other option.

Answer

Cloud VPN with dynamic routing

Answer

Partner Interconnect via a service provider

Answer

Direct Peering

Question 11

A company hosts a web application on Compute Engine behind a global HTTP(S) load balancer. They notice that some users experience high latency from certain regions. They want to improve performance without adding complexity. What should they do?

Accepted Answer

Enable Cloud CDN. Enabling Cloud CDN caches content at Google's globally distributed edge caches, reducing latency for users in regions far from the origin Compute Engine instances. This directly addresses the high-latency issue without adding complexity, as it requires no changes to the application architecture and is a simple configuration toggle on the load balancer backend bucket or backend service.

Answer

Add more instances in the same region

Answer

Use Premium Tier networking

Answer

Enable Cloud Armor

Question 12

A company is migrating a monolithic application to Google Cloud. The application consists of a stateful service that writes to local disk and a stateless web server. They want to minimize changes to the code. Which architecture should they use?

Accepted Answer

Lift and shift to Compute Engine instances with persistent disks for stateful service. It represents a lift-and-shift migration that minimizes code changes by running the monolithic application on Compute Engine instances. The stateful service can use persistent disks for local disk writes, while the stateless web server runs on the same or separate instances, preserving the existing architecture without refactoring.

Answer

Run the entire application on Cloud Run and use Cloud Filestore for shared state

Answer

Use App Engine Flexible Environment for the web server and Cloud SQL for state

Answer

Refactor the application into microservices and deploy on GKE with StatefulSets

Question 13

A company is designing a VPC architecture for a multi-tenant SaaS platform. Each tenant has isolated workloads that must not communicate with each other. They also need centralized network security and logging. Which VPC design meets these requirements?

Accepted Answer

Use a Shared VPC with separate subnets for each tenant and firewall rules to enforce isolation. Option B is correct because a Shared VPC in Google Cloud lets a host project centrally own and manage the VPC network, subnets, firewall rules, and logging while each tenant's service project gets its own subnet; firewall rules scoped to those subnets or service accounts enforce isolation so tenant workloads cannot communicate with each other. This design also satisfies the centralized network security and logging requirement, since the host project retains control of firewall policies and VPC Flow Logs across all tenant subnets. Option A does not provide tenant isolation or centralized logging, as Cloud VPN only establishes encrypted tunnels to on-premises or remote networks. Option C is unsuitable because a single VPC with network tags and IAP tunnels does not create hard tenant boundaries and IAP is for identity-based TCP access, not tenant segmentation. Option D is wrong because VPC peering connects networks rather than isolating tenants, and Cloud NAT only provides outbound internet access, not centralized security or logging.

Answer

Dedicated Cloud VPN connections per tenant

Answer

Single VPC with network tags and IAP tunnels

Answer

Peered VPCs for each tenant with Cloud NAT

Question 14

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Accepted Answer

The service account lacks IAM permissions to read from Cloud Storage. The correct answer is D: the service account lacks IAM permissions to read from Cloud Storage. Even when a service account is properly attached to a Compute Engine instance, the instance's applications can only access Cloud Storage buckets if that service account has been granted the appropriate IAM roles (for example, roles/storage.objectViewer) on the bucket or project. The failure to read from the bucket is therefore most likely an authorization issue at the IAM layer rather than a configuration problem with the instance itself. Option A is not the cause because the scenario states the instance uses its service account, and even a missing attachment would be a different setup issue. Option B is incorrect because firewall tags like http-server and https-server govern inbound HTTP/HTTPS traffic, not outbound access to the Cloud Storage API. Option C is incorrect because the boot disk type (SSD vs. standard) has no bearing on Cloud Storage access.

Answer

The service account is not attached to the instance

Answer

The tags http-server and https-server block outbound traffic

Answer

The boot disk type is SSD, which is not compatible with Cloud Storage

Question 15

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Accepted Answer

The developer is assigned only the objectViewer role. The correct answer is D: the developer is assigned only the objectViewer role. The objectViewer role (roles/storage.objectViewer) grants read-only access to objects, including listing and downloading, but it does not include storage.objects.create, so any upload attempt will fail with a permission denied error. Options A and B are unlikely because an organization policy denying all writes or project non-membership would typically produce broader failures or different errors, and there is no evidence in the scenario. Option C is incorrect because IAM permissions are additive; a service account's permissions do not override or reduce a user's granted roles, so my-sa cannot strip the developer's access.

Answer

An organization policy denies all write operations

Answer

The developer is not a member of the project

Answer

The service account my-sa overrides the developer's permissions