Google PCA Hard Questions — 25 Difficult Questions

Question 1

An organization uses Cloud Spanner with a multi-region configuration to achieve 99.999% availability for their global user base. They notice an increase in write latency during peak hours. Which action would MOST effectively reduce write latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add more nodes to the Spanner instance. In Cloud Spanner, write latency can be reduced by adding more nodes (increasing throughput) or optimizing schema. Adding nodes provides more compute and I/O capacity, reducing queuing and latency.

Answer

Use a stronger read consistency level

Answer

Change from a multi-region to a single-region configuration

Answer

Enable follower reads

Question 2

An engineer is designing a Bigtable schema for time-series data consisting of sensor readings. Each sensor emits a reading every second. The access pattern is to retrieve all readings for a specific sensor within a time range. Which row key design will provide the best performance?

Accepted Answer

Use row key: [sensor_id]#[reverse_timestamp]. Bigtable stores rows sorted by key. A row key structured as [sensor_id]#[reverse_timestamp] ensures that all data for a sensor is contiguous, and sorting by reverse timestamp allows recent data to be retrieved first. A single row key per sensor with column qualifiers would cause hotspots and limit scalability.

Answer

Use a single row per sensor with column qualifiers as timestamps

Answer

Use timestamp as the row key and sensor ID as column qualifier

Answer

Use a random prefix to distribute writes evenly

Question 3

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using the pod's own identity, without managing long-lived credentials. They have created a Google service account (GSA) and a Kubernetes service account (KSA). What should they do to bind the KSA to the GSA?

Accepted Answer

Add an annotation to the KSA referencing the GSA, and grant the KSA the iam.workloadIdentityUser role on the GSA. Workload Identity allows you to configure a KSA to act as a GSA by adding an annotation to the KSA and granting the GSA the necessary IAM role. The GSA does not impersonate the KSA; the KSA impersonates the GSA. The annotation is set on the KSA, not the pod. The GSA does not need to be bound to the KSA via an IAM role on the KSA.

Answer

Create a service account key and mount it as a secret in the pod

Answer

Grant the GSA the roles/iam.serviceAccountUser role on the project

Answer

Add an annotation to the GSA referencing the KSA, and grant the KSA the iam.workloadIdentityUser role on the GSA

Question 4

Refer to the exhibit. The SLO for the payments-api service is 99.9% availability over 30 days. The current compliance is 99.89% and the error budget is exhausted. Which action should the SRE team take FIRST?

Accepted Answer

Pause all non-critical deployments and investigate the cause of the increased error rate.. The error budget is exhausted, meaning the service has already consumed its allowed downtime for the 30-day window. The immediate priority is to stop further budget erosion by pausing non-critical deployments and investigating the root cause of the increased error rate. This aligns with SRE best practices: when the error budget is depleted, the team should shift focus from feature velocity to reliability, halting all non-essential changes until the cause is understood and mitigated.

Answer

Increase the SLO target to 99.99% to reduce future burn rate.

Answer

Trigger a rollback of the latest deployment to stabilize the service.

Answer

Scale up the service to handle more traffic and reduce error rate.

Question 5

A company uses Cloud Armor to protect an HTTPS Load Balancer. They want to allow traffic only from users who have passed a reCAPTCHA challenge. Cloud Armor supports which feature for this?

Accepted Answer

WAF rules with reCAPTCHA. Cloud Armor supports reCAPTCHA integration through WAF rules that use the 'token.recaptcha_session.score' or 'token.recaptcha_action.score' attributes to allow, deny, or redirect traffic based on the reCAPTCHA assessment score. This is configured as a security policy rule with a reCAPTCHA challenge action, enabling the load balancer to enforce human verification before granting access.

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Answer

Rate limiting

Question 6

An organization uses Cloud SQL for MySQL in a production environment. They need to ensure high availability with automatic failover in case of a zonal failure. Which configuration should they use?

Accepted Answer

Create a regional Cloud SQL instance with automatic failover.. A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

Answer

Create a read replica in a different region.

Answer

Export the database daily and import into a new instance if failure occurs.

Answer

Deploy Cloud SQL across multiple regions using cross-region replication.

Question 7

A company has a BigQuery dataset with a growing fact table (500 million rows, added daily). Queries that filter on a date column and group by a product ID are slow. The team wants to optimise query performance without increasing slot costs. Which two actions should they take? (Choose TWO.)

Accepted Answer

Cluster the table by the product ID column. Partitioning by date and clustering by product ID can significantly improve query performance: partitioning prunes scans to relevant days, and clustering co-locates rows with similar product IDs. Materialised views pre-aggregate data but increase storage costs. SELECT * is inefficient and should be avoided. Slots pricing does not help performance without changing configuration.

Answer

Switch to BigQuery Editions with Autoscaling slots

Answer

Use SELECT * only when necessary

Answer

Create a materialised view that pre-aggregates the data

Question 8

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is a GCP service designed to store, manage, and access secrets such as API keys, passwords, and certificates. It supports automatic rotation of secrets via integration with Cloud Functions and other services, and provides versioning and audit logging.

Answer

Cloud HSM

Answer

Cloud KMS

Answer

Cloud Asset Inventory

Question 9

A team is designing a disaster recovery (DR) plan for a critical application. Which THREE components are essential for a robust DR plan? (Choose 3)

Accepted Answer

Failover procedures and runbooks. Failover procedures and runbooks (A) are essential because they provide step-by-step instructions for executing a controlled transition to the secondary site, ensuring minimal downtime and consistent recovery actions. Without documented runbooks, teams risk misconfigurations during a disaster, which can extend recovery time objectives (RTO) beyond acceptable limits.

Answer

A single-region deployment for consistency

Answer

Load testing to validate performance

Question 10

A financial services company is migrating a monolithic Java application to Google Kubernetes Engine (GKE) for improved scalability and reliability. The application serves real-time trading data and has strict latency requirements. Post-migration, the team observes frequent pod restarts due to OutOfMemory (OOM) errors, increased latency during peak trading hours, and occasional database connection timeouts. The current setup uses a single GKE cluster with a node pool of n1-standard-4 machines, a stateless application deployed as a Deployment with resource requests and limits set to 512 Mi memory and 1 CPU. The database is a Cloud SQL PostgreSQL instance with 2 vCPUs and 7.5 GB memory, and applications connect using a hardcoded connection string. The team wants to ensure reliable operation under load and during node maintenance events. Which course of action best addresses the reliability issues?

Accepted Answer

Adjust resource requests to 1 Gi memory and 2 CPU, set limits to 2 Gi and 4 CPU, create an HPA based on a custom metric (e.g., requests per second), enable cluster autoscaler, implement Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max connection pool size, and configure PDB with maxUnavailable 1.. Best addresses all reliability issues. Adjusting resource requests to 1 Gi memory and 2 CPU ensures proper scheduling, while limits of 2 Gi and 4 CPU prevent OOM errors. The HPA based on custom metrics (e.g., requests per second) scales pods proactively during peak trading hours. Cluster autoscaler handles node capacity, and Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max pool size prevents database connection timeouts. Finally, a PDB with maxUnavailable 1 ensures availability during node maintenance. Option B misses resource tuning, autoscaling, and connection pooling. Option C unnecessarily moves the database to GKE, increasing complexity and losing managed DB benefits. Option D lacks custom metric HPA, cluster autoscaler, and PDB, leaving gaps in scalability and maintenance handling.

Answer

Enable GKE node auto-upgrade, configure Pod Disruption Budgets (PDB) with minAvailable 1, and set readiness probes to check application health.

Answer

Migrate the database to a StatefulSet in GKE with persistent volumes, increase node count to 10, and enable cluster autoscaler.

Answer

Increase memory limits to 2 Gi and CPU to 2, add Horizontal Pod Autoscaler (HPA) based on CPU utilization, and implement connection pooling using Cloud SQL Auth Proxy.

Question 11

An organization needs to audit all changes to network firewall rules in a GCP project. Which service should be used to capture these changes?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify the configuration or metadata of resources, including changes to firewall rules. When a firewall rule is created, updated, or deleted, an audit log entry is automatically generated with details such as the user, timestamp, and the change made. This makes Cloud Audit Logs the correct service for auditing changes to network firewall rules in a GCP project.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Question 12

A company runs a critical application on Compute Engine that must remain available even if an entire zone fails. They have configured a managed instance group across three zones with autoscaling based on CPU utilization. The application state is stored in a Cloud SQL instance. Which additional step should they take to ensure high availability?

Accepted Answer

Configure a regional Cloud SQL instance with primary and standby in different zones.. Cloud SQL provides high availability with a standby instance in a different zone using regional persistent disk. This ensures failover if the primary zone fails.

Answer

Use a Cloud Load Balancer in front of the managed instance group.

Answer

Deploy a read replica of the Cloud SQL instance in another region.

Answer

Take frequent snapshots of the boot disk and store them in a multi-regional bucket.

Question 13

Which THREE steps can reduce processing costs in a Dataflow streaming pipeline? (Choose three.)

Accepted Answer

Use side inputs instead of a cross join.. Option A is correct because replacing a cross join with side inputs avoids the expensive fan-out of every element being paired with every element of the other collection, which drastically reduces the number of elements processed and shuffled in the streaming pipeline. Option B is correct because running non-critical data through a batch pipeline lets Dataflow use cheaper batch pricing and more efficient batch-optimized execution rather than paying for continuously running streaming workers. Option C is correct because GroupByKey in streaming mode forces a shuffle and holds state for each key until the window fires, so minimizing it (for example by using Combine or pre-aggregation) lowers shuffle volume, state storage, and processing cost. Option D is not correct because a custom runner does not reduce Dataflow processing costs and is not a cost-optimization step. Option E is not correct because increasing the number of workers raises the amount of compute used and therefore increases, rather than reduces, processing costs.

Answer

Use a custom runner.

Answer

Increase the number of workers.

Question 14

Refer to the exhibit. An engineer created an instance with a startup script that references a Cloud Storage bucket. The instance boots but the startup script fails. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket 'my-bucket' does not exist or the object 'startup.sh' is missing.. The error message indicates that the startup script cannot find the resource at gs://my-bucket/startup.sh. This could be because the bucket does not exist, the object does not exist, or the instance does not have permission to access the bucket. Given that the bucket is named 'my-bucket', it's likely that the bucket does not exist or the name is incorrect.

Answer

The startup script is not executable.

Answer

The instance does not have the appropriate IAM permissions to read from Cloud Storage.

Answer

The instance has no network connectivity to access Cloud Storage.

Question 15

A company needs to transfer 200 TB of data from on-premises to Cloud Storage within one week. The on-premises network upload speed is 100 Mbps. Which method should they use?

Accepted Answer

Order a Transfer Appliance. 200 TB at 100 Mbps = 200 * 1024 * 8 / (100/8) seconds ≈ 1,620,000 seconds ≈ 19 days, which exceeds one week. So network transfer is too slow. Transfer Appliance is a physical device for fast offline transfer. Storage Transfer Service is for cloud-to-cloud. gsutil rsync is an online tool. Velostrata is for VM migration.

Answer

Use Storage Transfer Service

Answer

Use gsutil rsync to transfer the data

Answer

Use Velostrata (Migrate for Compute Engine)

Question 16

An organization uses Cloud Functions (2nd gen) for event-driven processing. They notice that some functions fail with 'memory limit exceeded' errors during peak load. The function processes messages from Pub/Sub and writes to Firestore. What should they do to improve reliability without sacrificing throughput?

Accepted Answer

Increase the memory allocated to the Cloud Function.. The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.

Answer

Increase the maximum number of concurrent function instances.

Answer

Enable Pub/Sub batching to reduce the number of function invocations.

Answer

Split the function into multiple smaller functions, each handling a subset of the data.

Question 17

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

Accepted Answer

A firewall rule with the name 'my-firewall' already exists in the project.. The error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Answer

The user lacks IAM permissions to create firewall rules.

Answer

The network reference in the firewall rule is incorrect.

Answer

The deployment does not include a 'delete' policy for existing resources.

Question 18

Refer to the exhibit. A GKE cluster named 'prod-cluster' has network policy enabled with Calico. A deployment in the cluster uses a ServiceAccount that needs to pull images from a private Container Registry in the same project. Despite correct configuration of ImagePullSecrets, pods fail to pull images with 'AccessDenied' errors. What is the most likely cause?

Accepted Answer

The node service account lacks storage.objectViewer role on the registry bucket.. The node's service account (the GCE default service account or the one assigned to the cluster nodes) must have the `storage.objectViewer` role on the Container Registry's underlying Cloud Storage bucket. Even with correct ImagePullSecrets, the kubelet on each node uses the node's service account to authenticate with the registry when pulling images. Without this role, the node cannot read the image layers from the bucket, resulting in 'AccessDenied' errors.

Answer

The ImagePullSecret is not correctly base64-encoded.

Answer

The network policy blocks egress traffic to the Container Registry's endpoints.

Answer

The cluster's private cluster feature prevents access to external registries.

Question 19

An organization is using Shared VPC with multiple projects. They want to allow a service project to use a Cloud SQL instance created in the host project. Which step is required?

Accepted Answer

Create the Cloud SQL instance with a private IP and enable Private Services Access in the host project. When using Shared VPC, a service project can use a Cloud SQL instance with a private IP from the host project's VPC. To enable this, the Cloud SQL instance must be created with a private IP and Private Services Access must be configured in the host project. This establishes a VPC peering connection between the host project's VPC and the Google-managed Cloud SQL service network, allowing the service project's resources to communicate with the instance via internal IP.

Answer

Grant the service project's Cloud SQL service account the Cloud SQL Client role on the host project

Answer

Configure VPC peering between host and service project

Answer

Enable the Cloud SQL Admin API in the service project

Question 20

A company is using Cloud Armor with HTTP Load Balancing to protect a web application. They want to block traffic from specific IP ranges for all requests except those that include a valid reCAPTCHA token. Which Cloud Armor rule configuration should they use?

Accepted Answer

Create a deny rule for the IP ranges with a condition that the request does not contain a valid reCAPTCHA token.. Cloud Armor security rules support boolean conditions using operators like `request.path` or custom headers. By creating a deny rule for the specific IP ranges with a condition that the request does not contain a valid reCAPTCHA token (evaluated via the `hasRecaptchaToken()` function), you allow traffic from those IPs only when the token is present. This directly implements the requirement without affecting other traffic.

Answer

Use a rate-based rule to limit requests from those IP ranges and add a reCAPTCHA action.

Answer

Create a whitelist rule for the IP ranges and attach it as a deny rule with higher priority.

Answer

Use Identity-Aware Proxy (IAP) to block the IPs and reCAPTCHA for others.