Google PCA Design and plan a cloud solution architecture — Timed 100 Questions

Question 1

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

100 minute time limit — choose an answer to begin.

Accepted Answer

Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage. Option C is correct because enabling customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage gives the organization control over the key lifecycle via Cloud KMS, which PCI DSS auditors typically require for demonstrating ownership and rotation of encryption keys protecting cardholder data at rest. Option D is correct because VPC Service Controls creates a service perimeter around Cloud SQL and Cloud Storage APIs, preventing data exfiltration and unauthorized access from outside the trusted perimeter, which directly supports PCI DSS network and access-control requirements for in-transit protection. Options A, B, and E are not the right choices: client-side encryption (A) adds complexity and does not by itself satisfy the full scope of PCI DSS controls for managed services; relying solely on Google-managed default encryption (B) removes customer control over keys, which auditors often reject; and Cloud HSM with an externally generated key (E) is not required for Cloud SQL/Cloud Storage CMEK and is over-engineered for this scenario.

Answer

Configure client-side encryption in the application code

Answer

Rely on Google-managed default encryption for all data

Answer

Use Cloud HSM with a key generated outside of Google Cloud

Question 2

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Accepted Answer

The VM was created without an external IP address. The most likely reason for the timeout is that the VM was created without an external (public) IP address. Without an external IP, the VM is not directly reachable from the internet, even if nginx is running and firewall rules allow HTTP traffic. The timeout occurs because the internet has no route to the VM's private IP address.

Answer

The VM is in a subnet without a Cloud NAT

Answer

The firewall rule allowing HTTP traffic is missing

Answer

The startup script failed to install nginx

Question 3

A media streaming company is deploying a new video transcoding pipeline on Google Cloud. The pipeline receives raw video files uploaded to Cloud Storage, triggers a Cloud Function that submits transcoding jobs to a Compute Engine worker pool, and stores the transcoded output in another Cloud Storage bucket. The workers are managed by a managed instance group (MIG) running a custom container image. Currently, when there is a spike in uploads, the MIG takes 5-7 minutes to scale up new workers, causing processing delays. The architect needs to reduce the time to add new workers to under 2 minutes. The workers are stateless and the container image is about 2 GB. What should the architect do?

Accepted Answer

Create a custom Compute Engine image that includes the container runtime and pre-pulled container. Creating a custom Compute Engine image that includes the container runtime and pre-pulls the 2 GB container image eliminates the need to download the image during scale-up. This reduces the instance startup time from 5-7 minutes to under 2 minutes, as the container is already cached locally on the image, bypassing the network pull delay.

Answer

Use Cloud Run instead of Compute Engine to run the transcoding workers

Answer

Increase the minimum number of instances in the MIG to 10

Answer

Replace the Compute Engine workers with Cloud Functions to handle the transcoding

Question 4

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

100 minute time limit — choose an answer to begin.

Accepted Answer

Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.. It uses Cloud Spanner's multi-region configuration, which provides synchronous replication across regions with automatic failover, meeting an RPO of 15 minutes (typically seconds) and an RTO of 1 hour. Active-active traffic load balancing with Compute Engine ensures that the application can immediately route traffic to the healthy region, minimizing downtime without the need for manual failover or backup/restore operations.

Answer

Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.

Answer

Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.

Answer

Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.

Question 5

Match each Google Cloud service to its primary purpose.

Accepted Answer

Cloud VPC: Isolated virtual network for GCP resources. These are core networking services in GCP. Cloud VPC provides isolated virtual networks, Cloud Load Balancing distributes traffic, Cloud CDN caches content at the edge, and Cloud NAT enables outbound internet for private instances. Common confusion: mixing up VPC and Load Balancing definitions, or CDN and NAT.

Answer

Cloud VPC: Distributes incoming traffic across multiple instances

Answer

Cloud CDN: Network address translation for private instances to access internet

Question 6

A company has a hub-and-spoke VPC topology with multiple on-premises locations connected via Cloud VPN to the hub VPC. They notice IP conflicts because overlapping CIDR ranges are used in different spokes. The network team wants to allow communication between spokes without re-IPing. What should they do?

Accepted Answer

Use Cloud NAT in each spoke and private routing via the hub with network tags to distinguish ranges.. Using Cloud VPN tunnels between spokes through the hub allows the hub to route traffic between spokes based on the tunnel interfaces. By assigning unique IP addresses to each tunnel endpoint (e.g., 10.254.0.1 for Spoke A and 10.254.0.2 for Spoke B), the hub can forward packets without relying on the overlapping spoke CIDRs. The spokes use static routes pointing to their respective tunnel interfaces, ensuring that traffic is encapsulated over IPsec and decapsulated at the destination, bypassing the IP conflict. This approach avoids re-IPing while enabling communication, though it introduces additional overhead and complexity.

Answer

Use Cloud VPN tunnels between spokes through the hub.

Answer

Configure static routes in the hub to summarize ranges with a smaller prefix.

Answer

Create VPC peering between each spoke VPC.

Question 7

An organization has multiple Google Cloud projects that need to access a shared Cloud SQL database. The database should only be accessible from authorized projects. What is the most secure way to grant access?

Accepted Answer

Configure the Cloud SQL instance with a private IP in a shared VPC and grant IAM roles to the authorized projects.. Using a private IP in a shared VPC ensures that Cloud SQL is not exposed to the public internet, and IAM roles (e.g., roles/cloudsql.client) allow fine-grained access control at the project level. This approach leverages VPC peering or shared VPC to restrict network access exclusively to authorized projects, eliminating the need for public IPs or complex VPN configurations while maintaining high security.

Answer

Use Cloud SQL Proxy on each project's Compute Engine instances.

Answer

Expose the Cloud SQL instance on a public IP and authorize the IP ranges of the projects.

Answer

Set up a Cloud VPN between each project's VPC and the VPC hosting Cloud SQL.

Question 8

A company is building a real-time data pipeline that ingests events from IoT devices, processes them with Apache Beam, and stores results in BigQuery for analytics. The pipeline must handle spikes in traffic and guarantee exactly-once processing. Which combination of services should they use?

Accepted Answer

Cloud Pub/Sub, Dataflow, and BigQuery.. Cloud Pub/Sub provides scalable, asynchronous ingestion for IoT event spikes, Dataflow (which runs Apache Beam) offers exactly-once processing semantics via checkpointing and idempotent sinks, and BigQuery serves as the analytics destination. This combination meets all requirements: Pub/Sub decouples producers from consumers, Dataflow handles stateful processing with exactly-once guarantees, and BigQuery supports real-time streaming inserts.

Answer

Cloud Pub/Sub, Dataproc, and BigQuery.

Answer

Cloud IoT Core, Data Fusion, and Cloud Bigtable.

Answer

Cloud Storage, Cloud Functions, and BigQuery.

Question 9

Which TWO statements are true regarding the benefits of using VPC Network Peering over Cloud VPN for connecting two VPC networks?

Accepted Answer

VPC Network Peering provides lower latency because traffic stays within Google's network.. Option A is correct because VPC Network Peering routes traffic directly between the two VPC networks over Google's private backbone, avoiding the public internet and the encryption/decryption overhead of IPsec tunnels, which yields lower latency and higher throughput. Option C is correct because Cloud VPN traffic traverses external IP addresses and is billed for egress, whereas VPC Network Peering traffic stays internal to Google's network and is generally not charged for egress between peered VPCs (though other charges may apply). Option B is wrong because VPC Network Peering is a native Google Cloud feature requiring no VPN gateway appliance or tunnels. Option D is wrong because VPC Network Peering can connect VPC networks across different projects and even different organizations, not only within the same organization. Option E is wrong because Cloud VPN does encrypt traffic via IPsec, but VPC Network Peering traffic is also encrypted in transit within Google's infrastructure, so this is not a differentiating benefit.

Answer

VPC Network Peering requires a separate VPN gateway appliance.

Answer

VPC Network Peering can only be established within the same organization.

Answer

Cloud VPN encrypts traffic, which VPC Network Peering does not.

Question 10

A startup is building a web application that experiences unpredictable traffic spikes. They want a scalable solution that minimizes costs. Which Google Cloud service should they use to run their containerized application?

Accepted Answer

Google Kubernetes Engine (GKE) with autoscaling. Google Kubernetes Engine (GKE) with autoscaling is the correct choice because it combines cluster autoscaling (which adjusts the number of nodes based on pod resource requests) with Horizontal Pod Autoscaling (which scales the number of pod replicas based on CPU/memory utilization or custom metrics). This dual-layer scaling handles unpredictable traffic spikes efficiently while minimizing costs by only provisioning resources when needed, and it is purpose-built for containerized applications.

Answer

App Engine Standard Environment

Answer

Cloud Run for Anthos

Answer

Compute Engine with managed instance groups

Question 11

You need to store object data that is accessed infrequently (once a quarter) but must be retained for 10 years for compliance. Which storage class is the most cost-effective?

Accepted Answer

Coldline. For data accessed once a quarter (every 90 days), Coldline is the most cost-effective storage class. Coldline offers lower storage cost than Standard or Nearline, with retrieval costs lower than Archive's. The 90-day minimum storage duration aligns with the retention requirement, and retrieval time (typically under 1 minute) is acceptable for infrequent access. Archive is designed for data accessed less than once a year and has higher retrieval costs, making it less cost-effective for quarterly access.

Answer

Archive

Answer

Standard

Answer

Nearline

Question 12

A company is designing a multi-region architecture for disaster recovery. Their primary region is us-central1 and they want a warm standby in another region. The application runs on Compute Engine with a stateful backend. Which approach minimizes RTO while keeping costs reasonable?

Accepted Answer

Use a managed instance group in the secondary region with persistent disk snapshots and Cloud Load Balancing failover. Minimizes RTO by pre-provisioning Compute Engine instances in the secondary region via a managed instance group, using persistent disk snapshots for stateful data. This warm standby approach keeps instances ready to serve traffic with minimal startup delay, while Cloud Load Balancing failover automatically redirects traffic on primary region failure, balancing cost and recovery speed.

Answer

Use Cloud SQL cross-region replication and start Compute Engine instances on failover

Answer

Replicate the application to Cloud Run in the secondary region

Answer

Set up a managed instance group with instance templates in the secondary region without pre-provisioned instances

Question 13

A financial services company requires that all data stored in Cloud Storage be encrypted with keys they manage, rotate, and audit. They also need to enforce encryption at the bucket level. Which configuration should they use?

Accepted Answer

Use Cloud KMS with customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) with Cloud KMS allow the company to manage, rotate, and audit their own encryption keys while enforcing encryption at the bucket level. This meets the requirement of controlling key lifecycle and auditing, as Cloud KMS integrates with Cloud Audit Logs for key usage tracking.

Answer

Use default Google-managed encryption

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Enable CMEK at the bucket level with a Cloud KMS key

Question 14

A company has a Cloud SQL for PostgreSQL instance with high read traffic. They want to offload read queries without modifying the application. Which strategy should they implement?

Accepted Answer

Create read replicas and configure the application to use them. Creating read replicas in Cloud SQL for PostgreSQL allows you to offload read traffic from the primary instance without modifying the application, because the replicas are fully managed and can serve read queries directly. The application can be configured to point to the read replica's endpoint, which handles SELECT statements while the primary continues to handle writes. This is the most direct and cost-effective solution for high read traffic when application changes are not permitted.

Answer

Increase the machine type of the primary instance

Answer

Implement a caching layer using Memorystore

Answer

Migrate to Cloud Spanner for better scalability

Question 15

Which TWO actions reduce egress costs when transferring data from Compute Engine to the internet? (Choose 2)

Accepted Answer

Use Cloud CDN to cache content. Cloud CDN caches content at edge locations, reducing the amount of data served from the origin Compute Engine instance, thus lowering egress costs. Compressing data before transfer reduces the volume of data sent, directly decreasing egress costs. Cloud NAT does not affect egress costs; it only provides outbound connectivity. Moving instances to a lower-cost region does not reduce egress costs because egress pricing is similar across regions. Premium Tier networking typically increases costs due to higher per-GB charges.

Answer

Use Cloud NAT for outbound traffic

Answer

Move instances to a lower-cost region

Answer

Use Premium Tier networking

Question 16

Which THREE are best practices for designing a highly available Cloud SQL for MySQL instance? (Choose 3)

Accepted Answer

Enable automatic backups. Automatic backups in Cloud SQL for MySQL provide point-in-time recovery (PITR) capabilities, which are essential for data durability and disaster recovery. Enabling automatic backups ensures that transaction logs are retained, allowing you to restore your database to any point within the backup retention period, typically up to 7 days.

Answer

Configure cross-region replication

Answer

Set a maintenance window in off-peak hours

Question 17

A company wants to deploy a stateful application with strict low-latency requirements across multiple zones in a single region. They need to minimize inter-zone latency. Which THREE actions should they take? (Choose 3)

Accepted Answer

Place application instances in the same zone to minimize network hops. Option A is correct because co-locating application instances in the same zone eliminates inter-zone network hops, which is the most direct way to minimize latency for a stateful, latency-sensitive workload. Option B is correct because zonal SSD persistent disks provide high-throughput, low-latency block storage that is physically attached within the same zone, avoiding the added latency of cross-zone or regional disk replication. Option D is correct because a regional internal TCP/UDP load balancer distributes traffic across instances within a region using a single internal IP, and when combined with same-zone placement it keeps the data path local and avoids unnecessary cross-zone hops. Option C is not appropriate because spreading instances across multiple zones in a managed instance group increases inter-zone latency, which contradicts the stated goal. Option E is not appropriate because Dedicated Interconnect addresses on-premises-to-cloud connectivity and does not reduce latency between zones within a single region.

Answer

Deploy instances in a managed instance group across multiple zones

Answer

Use Dedicated Interconnect for on-premises connection

Question 18

A company is migrating a critical on-premises application to Google Cloud. The application consists of a frontend web server that handles user requests and a backend database server that stores session state and processed data. The application is stateful because session data is stored in memory on the backend server. The company wants to minimize downtime during migration and ensure that the application can scale horizontally in the future. The current on-premises architecture has the web server and database server on separate physical machines. The web server communicates with the database server via a private network. The company expects that after migration, the application will need to handle double the current traffic. They also need to ensure that the architecture is resilient to zone failures within a single region. They are considering using Compute Engine for both the web and database servers, but they are open to other Google Cloud services. They have a requirement that the database must be relational and support ACID transactions. The database currently uses Microsoft SQL Server, but they are willing to migrate to a different database engine if it reduces operational overhead and provides better scalability. The team has limited experience with Google Cloud and wants to minimize architectural changes. Which course of action should the company take?

Accepted Answer

Migrate the web server to Compute Engine with a managed instance group and internal load balancer. Migrate the database to Cloud SQL for SQL Server with high availability across zones.. It preserves the existing stateful architecture by using Compute Engine with a managed instance group and internal load balancer for the web tier, and Cloud SQL for SQL Server with cross-zone high availability for the database. This minimizes architectural changes, supports horizontal scaling via the managed instance group, and provides zone-level resilience for the relational database with ACID transactions, meeting the requirement to handle double traffic while minimizing downtime.

Answer

Refactor the application to be stateless. Migrate the web server to App Engine and the database to Cloud SQL for PostgreSQL. Use Cloud Memorystore for session state.

Answer

Migrate the web server to Compute Engine and the database to Cloud Spanner. Use a global load balancer for the web server and Spanner for transactional consistency.

Answer

Lift and shift both web and database servers to Compute Engine. Use a managed instance group with autoscaling for the web server and a standalone VM for the database. Configure persistent disks for data.

Question 19

Refer to the exhibit. A user alice@example.com is unable to list objects in bucket 'bucket-b'. What is the most likely reason?

Accepted Answer

The condition restricts access only to bucket-a.. The IAM policy condition explicitly restricts access to resources with a name matching 'bucket-a'. Since the user is trying to list objects in 'bucket-b', the condition evaluates to false, and the IAM policy does not grant the required permissions. Without a matching condition, the effective permission set is empty, causing the list operation to fail.

Answer

The IAM policy is missing the roles/storage.objectAdmin role.

Answer

The condition expression is invalid.

Answer

The user needs the roles/storage.legacyBucketReader role.

Question 20

Refer to the exhibit. A user creates a snapshot of a persistent disk. Later, they want to create a new VM from this snapshot in the same project but in a different region (europe-west1). Which step is missing or incorrect?

Accepted Answer

The user must wait for the snapshot operation to complete before using it to create a VM.. A snapshot operation is asynchronous; the snapshot must reach the 'READY' state before it can be used to create a VM. Attempting to create a VM from a snapshot that is still being created will fail, as the snapshot data is not yet fully available.

Answer

The snapshot cannot be used to create a VM in a different region; the user must first create a disk in the same region and then replicate it.

Answer

The snapshot must be created with '--storage-location=europe-west1' to be usable in that region.

Answer

The user must specify the '--region' flag when creating the snapshot to make it available in europe-west1.