Google PCA Design and plan a cloud solution architecture — Timed 10 Questions

Question 1

A company has a hub-and-spoke VPC topology with multiple on-premises locations connected via Cloud VPN to the hub VPC. They notice IP conflicts because overlapping CIDR ranges are used in different spokes. The network team wants to allow communication between spokes without re-IPing. What should they do?

10 minute time limit — choose an answer to begin.

Accepted Answer

Use Cloud NAT in each spoke and private routing via the hub with network tags to distinguish ranges.. Using Cloud VPN tunnels between spokes through the hub allows the hub to route traffic between spokes based on the tunnel interfaces. By assigning unique IP addresses to each tunnel endpoint (e.g., 10.254.0.1 for Spoke A and 10.254.0.2 for Spoke B), the hub can forward packets without relying on the overlapping spoke CIDRs. The spokes use static routes pointing to their respective tunnel interfaces, ensuring that traffic is encapsulated over IPsec and decapsulated at the destination, bypassing the IP conflict. This approach avoids re-IPing while enabling communication, though it introduces additional overhead and complexity.

Answer

Use Cloud VPN tunnels between spokes through the hub.

Answer

Configure static routes in the hub to summarize ranges with a smaller prefix.

Answer

Create VPC peering between each spoke VPC.

Question 2

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

Accepted Answer

Cloud Run (fully managed).. Cloud Run (fully managed) is the correct choice because it is a serverless container platform that scales to zero, meaning no cost when idle, and scales automatically with demand. It requires no infrastructure management, perfect for a startup with limited operational experience. Option A (App Engine Standard) is wrong because it only supports specific runtimes (e.g., Python, Java, Go), not custom containers, and is not ideal for containerized applications. Option B (GKE) is wrong because it requires managing a Kubernetes cluster, including node pools, which adds operational overhead. Option C (Compute Engine with managed instance group) is wrong because it still requires provisioning and scaling configuration, and does not scale to zero.

Answer

App Engine Standard Environment with a custom runtime.

Answer

Google Kubernetes Engine (GKE) with a multi-node pool.

Answer

Compute Engine with a managed instance group.

Question 3

You need to store object data that is accessed infrequently (once a quarter) but must be retained for 10 years for compliance. Which storage class is the most cost-effective?

Accepted Answer

Coldline. For data accessed once a quarter (every 90 days), Coldline is the most cost-effective storage class. Coldline offers lower storage cost than Standard or Nearline, with retrieval costs lower than Archive's. The 90-day minimum storage duration aligns with the retention requirement, and retrieval time (typically under 1 minute) is acceptable for infrequent access. Archive is designed for data accessed less than once a year and has higher retrieval costs, making it less cost-effective for quarterly access.

Answer

Archive

Answer

Standard

Answer

Nearline

Question 4

A company is designing a VPC architecture for a multi-tenant SaaS platform. Each tenant has isolated workloads that must not communicate with each other. They also need centralized network security and logging. Which VPC design meets these requirements?

Accepted Answer

Use a Shared VPC with separate subnets for each tenant and firewall rules to enforce isolation. Using a Shared VPC with separate subnets per tenant and firewall rules to enforce isolation provides centralized network security and logging while keeping tenants isolated. Option A is incorrect because dedicated Cloud VPN connections per tenant do not provide isolation within the VPC and are more for hybrid connectivity. Option C is incorrect because a single VPC with network tags and IAP tunnels does not enforce strict isolation between tenants and relies on tags which can be misconfigured. Option D is incorrect because peered VPCs for each tenant with Cloud NAT would create multiple VPCs but does not provide centralized management and logging as easily as a Shared VPC.

Answer

Dedicated Cloud VPN connections per tenant

Answer

Single VPC with network tags and IAP tunnels

Answer

Peered VPCs for each tenant with Cloud NAT

Question 5

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Accepted Answer

The service account lacks IAM permissions to read from Cloud Storage. The web server fails to read from Cloud Storage because the service account attached to the Compute Engine instance lacks the necessary IAM permissions (e.g., roles/storage.objectViewer) on the storage bucket. Although the command includes --scopes=cloud-platform, which grants broad API access, IAM permissions are distinct from OAuth scopes. The service account must be granted explicit IAM roles to access Cloud Storage resources. Option A is incorrect because a service account is specified and attached via --service-account. Option B is incorrect because the boot disk type (pd-ssd) is compatible and does not affect storage access. Option C is incorrect because the tags http-server and https-server are used for firewall rules and do not impact outbound traffic to Cloud Storage.

Answer

The service account is not attached to the instance

Answer

The tags http-server and https-server block outbound traffic

Answer

The boot disk type is SSD, which is not compatible with Cloud Storage

Question 6

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Accepted Answer

The developer is assigned only the objectViewer role. The most likely reason is that the developer (admin@example.com) has only the roles/storage.objectViewer role on the bucket, which allows read-only access. The roles/storage.objectAdmin role is assigned to a service account, not to the developer. Therefore, the developer cannot upload files. Option A is incorrect because an organization policy denying all write operations would be a different mechanism and not indicated. Option B is incorrect because the developer is a member of the project (as shown). Option C is incorrect because IAM permissions are additive, not overriding; the service account's permissions do not affect the developer's effective permissions.

Answer

An organization policy denies all write operations

Answer

The developer is not a member of the project

Answer

The service account my-sa overrides the developer's permissions

Question 7

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Accepted Answer

Deployment with pod anti-affinity rules spread across zones. Deployments support rolling updates for zero-downtime deployments, and pod anti-affinity rules can be configured to spread pods across different zones, ensuring high availability. StatefulSets are intended for stateful workloads requiring stable network identities and persistent storage, not for stateless microservices. DaemonSets run one pod per node, typically for node-level services like logging, not for scaling microservices. Jobs are for batch processing and do not provide rolling updates or high availability across zones.

Answer

StatefulSet with volumeClaimTemplates for persistent storage

Answer

Job for batch processing

Answer

DaemonSet to ensure one pod per node

Question 8

Your company has migrated its legacy web application from a single Compute Engine instance to a managed instance group (MIG) behind an HTTP(S) load balancer. The application was updated to a new version as part of the migration. After the migration, users report intermittent 502 Bad Gateway errors. The application logs show no errors, and the load balancer backend health checks are reported as healthy. On investigation, the developers discover that the new version requires a specific environment variable for authentication to a downstream service. This variable was set manually on the original instance but is missing from the MIG's instance template. The health check endpoint does not depend on this variable and always returns a 200 status even when the variable is absent. As a result, instances created from the template are considered healthy by the load balancer, but when they receive requests that require authentication, they fail and return a 502 error to the client. What is the most likely cause of the 502 errors?

Accepted Answer

The missing environment variable causes authentication failures on new instances.. The 502 errors occur because the new application version requires a specific environment variable for authentication to a downstream service. The health check endpoint does not depend on this variable, so instances are marked healthy even though they cannot authenticate real requests. When the load balancer routes traffic to these instances, the missing variable causes authentication failures, leading to 502 Bad Gateway errors.

Answer

The health check is configured to check the old application path, which no longer exists.

Answer

The load balancer's backend timeout is too short for the application's response time.

Answer

The MIG is not scaling out fast enough to handle peak traffic.

Question 9

Refer to the exhibit. An engineer is investigating why web-01 was removed from the load balancer target pool. What is the most likely root cause?

Accepted Answer

The firewall rule allowing traffic from web-01 to db-01 on port 3306 has been removed or misconfigured.. The exhibit shows that web-01 was removed from the load balancer target pool. In Google Cloud, a load balancer health check determines instance eligibility; if the health check fails, the instance is automatically removed. The most likely root cause is that the firewall rule allowing traffic from web-01 to db-01 on port 3306 has been removed or misconfigured, which would cause the health check (which often tests connectivity to a backend service like a database) to fail, leading to removal.

Answer

The database instance db-01 is running out of memory and rejecting connections.

Answer

The load balancer health check is misconfigured to use an incorrect port.

Answer

The instance web-01 is running an outdated version of the web server software.

Question 10

A company is migrating on-premises workloads to Google Cloud. They have a critical application that requires consistent low-latency access to a database, with read replicas in multiple regions for disaster recovery. The application is expected to grow by 10x over the next year. Which database service and configuration should the architect choose to meet these requirements?

Accepted Answer

Use Cloud Spanner with multi-region configuration. Cloud Spanner with a multi-region configuration is the correct choice because it provides strong global consistency, low-latency reads and writes across regions, and automatic horizontal scaling to handle a 10x growth in workload. Its multi-region replication ensures synchronous replication for disaster recovery while maintaining ACID transactions, which is critical for a database requiring consistent low-latency access.

Answer

Use Cloud Bigtable with multi-region replication

Answer

Use Cloud SQL for PostgreSQL with cross-region read replicas

Answer

Use Firestore in native mode with multi-region location