Google PCA Design and plan a cloud solution architecture Practice Test 6 — 15 Questions

Question 1

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deployment with pod anti-affinity rules spread across zones. The correct option is B: a Deployment with pod anti-affinity rules spread across zones. Deployments are the standard GKE workload for stateless microservices, providing declarative rolling updates (via RollingUpdate strategy with maxSurge/maxUnavailable) and integration with the Horizontal Pod Autoscaler for automatic scaling, while pod anti-affinity (or topologySpreadConstraints) spreads replicas across multiple zones for high availability. StatefulSet (A) is designed for stateful workloads needing stable network identities and per-pod PersistentVolumes, not for stateless services requiring rolling updates and autoscaling. Job (C) runs finite batch tasks to completion rather than long-running services, and DaemonSet (D) schedules one pod per node for node-level agents, not scalable service replicas.

Answer

StatefulSet with volumeClaimTemplates for persistent storage

Answer

Job for batch processing

Answer

DaemonSet to ensure one pod per node

Question 2

A company is planning a hybrid cloud architecture using Anthos to manage workloads across on-premises data centers and Google Cloud. They need to select two key components that enable consistent configuration, policy, and security across environments. Which two should they choose?

Accepted Answer

GKE on-prem. GKE on-prem (B) is correct because it extends the Google Kubernetes Engine control plane to on-premises data centers, letting the company run the same Kubernetes-based workload platform in both environments so configuration and security policies can be applied consistently. Config Sync (D) is correct because it continuously reconciles cluster configuration and policy from a central source of truth (typically a Git repository) across both on-prem and Google Cloud clusters, which is exactly what Anthos uses to enforce consistent configuration, policy, and security at scale. Cloud Interconnect (A) only provides private, high-bandwidth network connectivity between on-premises and Google Cloud and does not manage configuration or policy. Cloud Build (C) is a CI/CD service for building and deploying artifacts, not a mechanism for enforcing cross-environment configuration or policy. Cloud Load Balancing (E) distributes traffic to backends and provides no configuration, policy, or security consistency across environments.

Answer

Cloud Interconnect

Answer

Cloud Build

Answer

Cloud Load Balancing

Question 3

Your company has migrated its legacy web application from a single Compute Engine instance to a managed instance group (MIG) behind an HTTP(S) load balancer. The application was updated to a new version as part of the migration. After the migration, users report intermittent 502 Bad Gateway errors. The application logs show no errors, and the load balancer backend health checks are reported as healthy. On investigation, the developers discover that the new version requires a specific environment variable for authentication to a downstream service. This variable was set manually on the original instance but is missing from the MIG's instance template. The health check endpoint does not depend on this variable and always returns a 200 status even when the variable is absent. As a result, instances created from the template are considered healthy by the load balancer, but when they receive requests that require authentication, they fail and return a 502 error to the client. What is the most likely cause of the 502 errors?

Accepted Answer

The missing environment variable causes authentication failures on new instances.. The 502 errors occur because the new application version requires a specific environment variable for authentication to a downstream service. The health check endpoint does not depend on this variable, so instances are marked healthy even though they cannot authenticate real requests. When the load balancer routes traffic to these instances, the missing variable causes authentication failures, leading to 502 Bad Gateway errors.

Answer

The health check is configured to check the old application path, which no longer exists.

Answer

The load balancer's backend timeout is too short for the application's response time.

Answer

The MIG is not scaling out fast enough to handle peak traffic.

Question 4

A company runs a multi-tier web application on Google Kubernetes Engine (GKE) with a frontend service, a backend service, and a Cloud SQL for PostgreSQL database. During peak hours, the frontend pod CPU usage is high (consistently above 80%), while the backend service shows moderate CPU usage (around 50%). Response times for user requests increase significantly, often exceeding the 200ms p99 latency target. Cloud SQL metrics show low query latency and no contention. The team wants to improve performance in a cost-effective manner. Which initial step should they take?

Accepted Answer

Increase the number of frontend pods by adjusting the horizontal pod autoscaler's target CPU utilization.. The frontend pods are CPU-bound during peak hours, causing increased response times. Increasing the number of frontend pods via the Horizontal Pod Autoscaler (HPA) by lowering the target CPU utilization threshold distributes the load across more replicas, directly addressing the bottleneck without additional infrastructure cost. This is the most cost-effective initial step because it leverages existing resources and autoscaling capabilities.

Answer

Add a read replica for Cloud SQL to offload read queries.

Answer

Migrate the backend service to a custom machine type with more vCPUs.

Answer

Enable vertical pod autoscaling for the backend service.

Question 5

A company is migrating a legacy on-premises application to Google Cloud. The application has strict low-latency requirements between its components and requires stateful TCP sessions. Which TWO design decisions should the architect recommend?

Accepted Answer

Use regional managed instance groups with internal load balancing.. Regional managed instance groups (MIGs) with internal load balancing are correct because they keep all compute instances within a single region, minimizing network hops and latency between components. Internal load balancing provides a single IP address for stateful TCP sessions without introducing the latency of a global proxy, and it supports session affinity (e.g., client IP affinity) to maintain stateful connections.

Answer

Use Cloud NAT for outbound connectivity.

Answer

Use global load balancing with Cloud CDN.

Answer

Use Cloud VPN for on-premises connectivity.

Question 6

A company runs a web application on Compute Engine instances behind a global HTTP(S) Load Balancer. The application uses Cloud SQL for MySQL for user data. Users report that during peak hours, the page load times increase significantly. The development team notices that the number of database connections exceeds the maximum allowed, causing some requests to fail. The application is designed to use connection pooling with a maximum pool size of 100 connections per instance. There are currently 10 instances. The Cloud SQL instance is configured with 4 vCPUs and 15 GB memory, and the maximum connections is set to 400. The application team wants to minimize cost while resolving the issue. What should the architect recommend?

Accepted Answer

Reduce the max pool size per instance to 40 connections.. With 10 instances each configured for a max pool of 100 connections, the theoretical peak is 1,000 connections — far exceeding Cloud SQL's 400-connection limit. Reducing the pool to 40 per instance yields a maximum of 400 connections, which fits within the limit and resolves the failures without any cost increase. This is the only option that addresses the root cause (over-provisioned pools) while honoring the 'minimize cost' constraint.

Answer

Increase the Cloud SQL instance tier to have more vCPUs and memory.

Answer

Implement connection pooling at the global HTTP(S) Load Balancer level.

Answer

Use Cloud SQL Proxy with connection pooling.

Question 7

Refer to the exhibit. An engineer deploys this Terraform configuration. After deployment, they can SSH into the VM using its public IP. However, they want to restrict SSH access to only a specific IP range (203.0.113.0/24). What change is required?

Accepted Answer

Change the 'source_ranges' in the firewall rule to ['203.0.113.0/24']. The instance already has the required tag.. The firewall rule already targets the instance via the 'ssh-allowed' tag, so the only change needed is to narrow the source_ranges from the current open range (e.g., 0.0.0.0/0) to ['203.0.113.0/24']. Since the instance already carries the required tag, no tag modification is necessary — just update the source range in the existing rule. This is the minimal, correct change to restrict SSH to the specified CIDR.

Answer

Modify the instance to use a network tag 'restricted-ssh' and update the firewall rule target_tags accordingly.

Answer

Add a new firewall rule with higher priority allowing SSH from 203.0.113.0/24, and keep the existing rule but change its priority to 100.

Answer

Update the 'source_ranges' in the firewall rule to ['203.0.113.0/24'] and remove the 'ssh-allowed' tag from the instance.

Question 8

Refer to the exhibit. All five nginx pods are scheduled on the same node (default-pool-1). What is the most likely reason?

Accepted Answer

The other nodes have taints that the pods do not tolerate.. Taints on nodes prevent pods from being scheduled unless the pods have corresponding tolerations. If the other nodes have taints that the nginx pods do not tolerate, the scheduler will only place them on nodes without those taints, which in this case is default-pool-1. This is a common scenario when nodes are dedicated to specific workloads or have special hardware.

Answer

The node auto-scaler has not created additional nodes yet, but the other nodes are present.

Answer

The pods have a nodeSelector that matches only default-pool-1.

Answer

The resource requests are too high, so the scheduler packed pods onto one node due to resource constraints on the others.

Question 9

Refer to the exhibit. An engineer deployed this Terraform configuration and can SSH to the instance using the external IP. However, they notice that the instance has a public IP address even though they intended to have no public IP. What change should be made to the configuration to ensure the instance does not get a public IP?

Accepted Answer

Remove the entire access_config block from the network_interface configuration.. The `access_config` block in a Terraform `google_compute_instance` resource is what assigns a public (external) IP address to the instance's network interface. By removing the entire `access_config` block, the instance will only receive a private IP address, fulfilling the requirement of no public IP. Leaving the block empty (as in option C) still creates an ephemeral external IP by default, so it does not solve the problem.

Answer

Change the metadata key enable-oslogin to FALSE.

Answer

Set access_config = [] instead of leaving it empty.

Answer

Set the network to a custom VPC that does not have external internet access.

Question 10

Refer to the exhibit. A developer is trying to connect to the Kubernetes API server from their workstation using the master IP (34.67.89.12) but receives a timeout. The developer can reach other external IPs. What is the most likely reason for the timeout?

Accepted Answer

The private cluster is configured with a private endpoint and public endpoint disabled, so the master IP is not accessible from outside the VPC.. A private GKE cluster with a private endpoint and public endpoint disabled means the Kubernetes API server is only reachable from within the cluster's VPC network. The developer's workstation is outside the VPC, so attempts to reach the master IP (34.67.89.12) will time out, even though other external IPs are reachable. This is a common configuration for security-sensitive workloads that require the API server to be isolated from the public internet.

Answer

The cluster is in a different region than the developer's VPC.

Answer

The developer's workstation does not have the required firewall rule to allow traffic to the master IP.

Answer

The Kubernetes Engine API is not enabled in the developer's project.

Question 11

A retail company is planning to migrate its on-premises data warehouse to Google Cloud. They want a fully managed, petabyte-scale, and highly scalable analytics data warehouse that supports ANSI SQL and integrates with their existing BI tools. Which Google Cloud service should they choose?

Accepted Answer

BigQuery. BigQuery is Google Cloud's fully managed, petabyte-scale analytics data warehouse that supports ANSI SQL and integrates with BI tools. It is serverless, highly scalable, and designed for analytical workloads. Cloud SQL is for transactional databases, Cloud Spanner is for global transactional consistency, and Cloud Bigtable is a NoSQL database for high-throughput applications, none of which are optimized for petabyte-scale SQL analytics.

Answer

Cloud Spanner

Answer

Cloud SQL

Answer

Cloud Bigtable

Question 12

A financial services firm is designing a new application on Google Cloud. The application must store sensitive customer data and comply with regulations that require encryption at rest with keys managed by the company. The company also needs to control key rotation and revocation. Which Google Cloud service should the solutions architect use to meet these requirements?

Accepted Answer

Cloud Key Management Service (Cloud KMS) with customer-managed encryption keys (CMEK).. Cloud KMS with customer-managed encryption keys gives the company full control over the lifecycle of encryption keys, including rotation and revocation, while integrating with Google Cloud services to encrypt data at rest. This meets the regulatory requirement for company-managed keys. Other services like IAP or DLP address different aspects of security and do not provide key management.

Answer

Cloud HSM to provide hardware security modules for key storage.

Answer

Cloud Data Loss Prevention (DLP) to discover and redact sensitive data.

Answer

Cloud Identity-Aware Proxy (IAP) to enforce access control and encrypt data in transit.

Question 13

A healthcare company is designing a system to process sensitive patient records on Google Cloud. They need to ensure that data is encrypted at rest with keys they control and can rotate on demand. They also require that the encryption keys are stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. Which Google Cloud service should they use?

Accepted Answer

Cloud HSM with Cloud KMS. Cloud HSM with Cloud KMS provides hardware security module-backed keys that are FIPS 140-2 Level 3 validated. It allows you to control key rotation and use them for encryption at rest across Google Cloud services. Google-managed keys do not give customer control, CMEK with standard Cloud KMS does not guarantee HSM storage, and CSEK requires external key management without HSM integration.

Answer

Google-managed encryption keys

Answer

Customer-managed encryption keys (CMEK) with Cloud KMS

Answer

Customer-supplied encryption keys (CSEK)

Question 14

A healthcare company is designing a solution to ingest and process millions of patient records daily. The data must be stored in a way that supports SQL queries and also allows for real-time analytics. The company wants to minimize operational overhead and needs a fully managed, petabyte-scale data warehouse. Which Google Cloud service should the solutions architect recommend?

Accepted Answer

BigQuery.. BigQuery is a serverless, highly scalable data warehouse that supports SQL and real-time analytics. It is fully managed, so the healthcare company can focus on analyzing data rather than managing infrastructure. It handles petabyte-scale datasets and daily ingestion of millions of records without manual scaling, making it the best fit for the requirements.

Answer

Cloud Spanner.

Answer

Cloud Bigtable.

Answer

Cloud SQL for PostgreSQL.

Question 15

A global e-commerce company is designing a multi-region architecture on Google Cloud to ensure high availability and low latency for users worldwide. They want to use a global load balancer that can route traffic to the closest healthy backend and support HTTP(S) and TCP traffic. Which Google Cloud load balancing option should they use?

Accepted Answer

Global external HTTP(S) load balancer and global external TCP proxy load balancer. Google Cloud offers separate global load balancers for different protocols. The global external HTTP(S) load balancer handles HTTP(S) traffic with proximity-based routing, while the global external TCP proxy load balancer handles TCP traffic with global anycast IP and proximity routing. Using both together provides the required support for both protocols in a multi-region architecture.

Answer

Global external HTTP(S) load balancer with TCP proxy

Answer

Global external TCP/UDP load balancer

Answer

Global external HTTP(S) load balancer