Google PCA Design and plan a cloud solution architecture Practice Test 9 — 15 Questions

Question 1

A retail company runs a Black Friday promotion and expects a burst of read traffic against a product-catalog database. The application is read-heavy, tolerates slightly stale data, and the team wants to scale reads horizontally without changing application code. They are using Cloud SQL for MySQL. Which design should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Cloud SQL read replica in the same region and point read queries at its IP address. Read replicas are the native Cloud SQL for MySQL mechanism for horizontal read scaling with asynchronous replication. Because the application tolerates slightly stale data, the replication lag is acceptable, and no code changes are needed beyond pointing read connections at the replica. A high-availability standby is not readable, Firestore requires a rewrite, and vertical scaling does not scale reads horizontally.

Answer

Enable Cloud SQL high availability by adding a standby instance and send read queries to the standby

Answer

Increase the primary instance's vCPU count and memory to absorb the read burst

Answer

Migrate the catalog to Firestore in Native mode and let the client SDK cache reads

Question 2

A healthcare company is deploying a new patient portal on Google Cloud. The portal must be accessible globally with low latency, must survive a single region failure, and must use a single anycast IP address. The backend runs on managed instance groups in two regions. Which Google Cloud product should the architect use to expose the service?

Accepted Answer

Global external HTTP(S) Load Balancing. Global external HTTP(S) Load Balancing is the only option that provides a single global anycast IP, edge termination, and automatic multi-region failover for HTTP(S) workloads. Regional proxies lack global anycast, Cloud DNS geo-routing introduces DNS caching delays and multiple IPs, and internal load balancing is not internet-facing. The chosen design satisfies global low latency and region-failure survivability.

Answer

Internal HTTP(S) Load Balancer with global access

Answer

Regional external TCP/SSL proxy load balancer

Answer

Cloud DNS with geo-routing and health checks

Question 3

An online retailer runs a stateless containerized API on Google Kubernetes Engine. Traffic is highly seasonal, spiking sharply during flash sales and dropping to near zero overnight. The operations team wants the cluster to add and remove nodes automatically based on pod demand while keeping costs low during idle periods. What should the architect recommend?

Accepted Answer

Enable cluster autoscaler on the node pools and configure a HorizontalPodAutoscaler on the API deployment.. Cluster autoscaler and HorizontalPodAutoscaler are complementary controls: the HPA adjusts replica count based on demand signals, and the cluster autoscaler provisions or removes nodes to match the resulting scheduling pressure. This combination gives the retailer elasticity during flash sales and near-zero node cost overnight without manual intervention.

Answer

Deploy the API on Cloud Run and remove the GKE cluster entirely, relying on request-based scaling.

Answer

Configure a regional managed instance group with a fixed size and enable autoscaling on the deployment only.

Answer

Set the node pool to a large fixed size sized for peak flash-sale traffic and rely on the scheduler to pack pods efficiently.

Question 4

An analytics team runs a batch pipeline that reads several terabytes of data from a Cloud Storage bucket in us-central1 every night. To reduce egress and improve throughput, they decide to run the pipeline on Compute Engine VMs in the same region and want the traffic to stay on Google's internal network without traversing the public internet. They also want the VMs to reach Google APIs such as Cloud Storage and BigQuery. Which configuration should the architect recommend?

Accepted Answer

Configure the VMs without external IPs and enable Private Google Access on the subnet. Private Google Access on the subnet is the supported mechanism that lets VMs with internal-only addresses reach Google APIs and services over Google's internal network. Because the VMs and the Cloud Storage bucket are in the same region, this configuration also keeps traffic local, reduces public internet exposure, and avoids the cost and complexity of NAT gateways or external IP addresses.

Answer

Assign external IP addresses to the VMs and rely on default internet routing to reach Google APIs

Answer

Deploy a NAT gateway on a separate VM and route all API traffic through it

Answer

Create a VPC peering connection between the project and the googleapis.com service project

Question 5

A media company is preparing to migrate a batch reporting application to Google Cloud. The application currently runs on physical servers that are used at about 20 percent CPU on average, but it has two short month-end peaks each quarter when utilization reaches 90 percent for about six hours. The company wants to reduce infrastructure cost while guaranteeing the application always has enough capacity during the peaks. What should the architect recommend?

Accepted Answer

Deploy the application on a managed instance group with autoscaling based on CPU utilization, with a minimum size that covers baseline load and a maximum size that covers the peaks.. The workload is spiky, with a low average and short, predictable peaks. Horizontal autoscaling on managed instance groups matches that shape: the group grows during the month-end surge and shrinks afterward, so cost tracks actual demand while the maximum size preserves guaranteed headroom. Fixed peak sizing, cluster autoscaler with a peak-sized minimum, and pinned Cloud Run minimum instances all keep peak capacity running continuously.

Answer

Deploy the application on a managed instance group of Compute Engine VMs sized for the month-end peak, using a committed use discount for the full capacity.

Answer

Deploy the application to a Google Kubernetes Engine cluster with a single large node pool and enable cluster autoscaler with a minimum node count equal to the peak requirement.

Answer

Deploy the application to Cloud Run with a minimum instance count set to the number of instances needed at peak and concurrency set to one.

Question 6

A logistics company runs a batch route-optimization job that reads 50 TB from Cloud Storage, performs CPU-intensive computation, and writes results back to Cloud Storage. The job runs for about four hours each night and must finish before the morning dispatch window. The team wants the lowest cost while guaranteeing completion within the window. Which compute design should the architect choose?

Accepted Answer

A Batch job with a task group that specifies a machine type and a maximum run duration, using standard provisioning. Batch is the managed service for running containerized batch workloads on Compute Engine. Specifying a task group with standard provisioning and a maximum run duration guarantees capacity for the four-hour job, and Batch handles Cloud Storage staging, retries, and job lifecycle. Preemptible options risk termination, Dataproc targets Spark and Hadoop, and Cloud Run timeouts prevent long-running jobs.

Answer

A managed instance group of preemptible VMs with an instance template that runs the batch job

Answer

A Cloud Run service with 8 vCPU and 32 GiB memory processing the job on a nightly Cloud Scheduler trigger

Answer

A Dataproc cluster with autoscaling enabled and secondary workers on preemptible VMs

Question 7

A healthcare company is planning to store sensitive patient records in Cloud Storage. They need to ensure that the data is encrypted at rest with keys that they control and can rotate on demand. They also want to maintain an audit trail of key usage. Which Google Cloud service should they use?

Accepted Answer

Cloud Key Management Service (Cloud KMS) with customer-managed encryption keys (CMEK).. Cloud KMS with customer-managed encryption keys gives the company full control over key creation, rotation, and usage. It integrates with Cloud Audit Logs to record key operations. The other options either do not provide customer control, lack auditability, or are not specific to the requirement.

Answer

Cloud HSM with a hardware security module for key storage.

Answer

Customer-supplied encryption keys (CSEK) stored on-premises.

Answer

Cloud Storage default encryption with Google-managed keys.

Question 8

A financial services firm is planning its Google Cloud resource hierarchy before migrating production workloads. The architecture team wants to enforce separation between business units, centralize network administration, and apply consistent IAM and policy controls across many projects. Which two design choices should the architect recommend? (Choose two.)

Accepted Answer

Use a Shared VPC host project to centralize network administration while service projects host the workloads. A folder-based hierarchy with inherited IAM and Organization Policy constraints gives centralized, consistent governance while separating business units. A Shared VPC host project centralizes network administration so service projects can consume subnets without owning network topology. Together these choices provide the separation, centralization, and consistent controls the firm requires while avoiding the risks of flat hierarchies or excessive organization-level permissions.

Answer

Grant the roles/owner role to each business unit's administrators at the organization level to simplify management

Answer

Place all projects directly under the organization node and manage permissions only at the project level

Answer

Create a separate organization node for each business unit to isolate billing and IAM

Question 9

A global e-commerce company is designing its application architecture on Google Cloud. The application must serve users from multiple regions with low latency and must be able to fail over between regions automatically in case of a regional outage. The company wants to minimize operational overhead and ensure that the database layer supports multi-region writes with strong consistency. Which database solution should they choose?

Accepted Answer

Cloud Spanner with a multi-region configuration.. Cloud Spanner is the only Google Cloud database that offers multi-region writes with strong consistency and automatic failover. It is designed for global applications requiring low latency and high availability. The other options either do not support multi-region writes or do not provide strong consistency across regions.

Answer

Cloud SQL for PostgreSQL with cross-region read replicas.

Answer

Cloud Bigtable with a multi-region cluster.

Answer

Firestore in Datastore mode with multi-region replication.

Question 10

A small development team is prototyping a containerized application on Google Cloud. They want the least operational overhead for running containers, automatic scaling based on incoming requests, and the ability to scale to zero when there is no traffic. They do not need Kubernetes APIs or custom networking. Which compute option should the architect recommend?

Accepted Answer

Cloud Run services with request-based autoscaling. Cloud Run is a fully managed serverless platform for containers that scales automatically based on requests and can scale to zero when idle. It removes the need to manage clusters, nodes, or autoscaling policies, which directly addresses the team's desire for minimal operational overhead and cost efficiency during periods without traffic.

Answer

Google Kubernetes Engine Autopilot cluster

Answer

Compute Engine managed instance groups with an autoscaler

Answer

Cloud Functions with a container image as the deployment artifact

Question 11

A financial analytics firm is deploying a new batch reporting platform on Google Cloud. The platform runs on a Managed Instance Group (MIG) of Compute Engine VMs and reads source data from a single Cloud Storage bucket. The security team requires that the VMs access the bucket without using long-lived service account keys, and that the identity be scoped specifically to this workload. They also want the permission to be automatically revoked when the VMs are deleted. Which approach should you recommend?

Accepted Answer

Create a dedicated service account, grant it roles/storage.objectViewer on the bucket, and attach it to the MIG as the instance service account.. Workload-scoped, keyless authentication on Compute Engine is achieved by attaching a dedicated service account to the instance template used by the MIG. The metadata server issues short-lived tokens to the application, so no static keys exist to leak or rotate, and the identity disappears with the instances. Granting only roles/storage.objectViewer on the specific bucket enforces least privilege for the reporting workload.

Answer

Use the Compute Engine default service account, which already has the Editor role, and add an IAM condition limiting access to the reporting project.

Answer

Enable Cloud Storage public access prevention and make the bucket readable by allAuthenticatedUsers, then restrict network access with VPC firewall rules.

Answer

Create a service account, generate a JSON key, store it in Secret Manager, and have the application mount it at runtime.

Question 12

A media company stores millions of small image files in a Cloud Storage bucket in the us-central1 region. Users in Europe and Asia report slow image load times. The company wants to improve read latency globally while keeping write operations in us-central1 for cost and simplicity. Which storage configuration should you recommend?

Accepted Answer

Keep the regional bucket in us-central1 and enable Cloud CDN on an external Application Load Balancer serving the images.. Cloud CDN caches content at Google's globally distributed edge points of presence, so readers in Europe and Asia are served from nearby locations while the authoritative data stays in the us-central1 regional bucket. Writes remain simple and centralized. Changing the bucket to a multi-region or dual-region location does not cover all three continents, and moving the origin to Asia violates the write-location requirement.

Answer

Change the bucket to a multi-region location such as US and enable Turbo Replication.

Answer

Move the images to a bucket in the asia-southeast1 region and use a global external Application Load Balancer to route users.

Answer

Recreate the bucket as a dual-region bucket with us-central1 and europe-west1, then serve images directly from the bucket.

Question 13

A company is planning to migrate a batch processing workload to Google Cloud. The workload runs nightly and can be interrupted without impacting the business. The company wants to minimize compute costs. Which Google Cloud service should they use?

Accepted Answer

Compute Engine Spot VMs. Spot VMs provide the deepest discounts for interruptible workloads and have no maximum runtime limit, unlike preemptible VMs. They are perfect for batch processing that can be paused or restarted. Committed use discounts require long-term commitments, and GKE Autopilot adds unnecessary complexity for a simple batch job. Spot VMs minimize compute costs while meeting the workload's tolerance for interruptions.

Answer

Google Kubernetes Engine (GKE) with Autopilot

Answer

Compute Engine committed use discounts (CUDs)

Answer

Compute Engine preemptible VMs

Question 14

A healthcare company must store patient records on Google Cloud. Regulatory requirements mandate that the data encryption keys be generated and stored outside Google Cloud, that the company control key rotation, and that access to the data be denied if the external key is unavailable. The data will be stored in Cloud Storage and BigQuery. Which approach should the architect recommend?

Accepted Answer

Configure Customer-Managed Encryption Keys by using Cloud KMS with an external key manager via Cloud EKM. Cloud External Key Manager allows Cloud KMS to wrap data encryption keys with key material held in an external key management system outside Google Cloud. Because access to the wrapped keys requires the external system, the company controls generation and rotation and can deny access by making the external key unavailable, meeting the regulatory requirements for both Cloud Storage and BigQuery.

Answer

Create Cloud KMS keys in a dedicated project and grant the services access to them

Answer

Encrypt data client-side with a locally stored key before uploading to Cloud Storage and BigQuery

Answer

Use Google-managed encryption keys and enable default encryption at rest for all services

Question 15

A company is deploying a new microservices application on Google Kubernetes Engine (GKE). They need to ensure that each microservice can be independently scaled and updated without affecting other services. They also want to minimize the blast radius of a failure in one microservice. Which design approach should they use?

Accepted Answer

Deploy each microservice as a separate Deployment with its own Horizontal Pod Autoscaler and use separate namespaces for isolation.. Using separate Deployments for each microservice enables independent scaling and rolling updates. Each Deployment can have its own HPA, and namespaces provide isolation. This design minimizes the impact of a failure in one service and aligns with microservices best practices. The other options either couple services together or lack automation and resilience.

Answer

Deploy all microservices in a single Deployment with multiple containers per pod.

Answer

Deploy each microservice as a separate pod without a controller, and manage them manually.

Answer

Use a single StatefulSet for all microservices to maintain persistent identities.