Google PCA Hard Questions — 25 Difficult Questions

Question 1

A financial services company is designing a multi-region application on Google Kubernetes Engine (GKE) for high availability. They need to serve user requests from the closest region and automatically failover if a region becomes unavailable. Which architecture should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy GKE clusters in multiple regions and use a multicluster ingress with an external HTTP(S) load balancer set up with the global external backend.. Deploying GKE clusters in multiple regions and using a multicluster ingress with a global external HTTP(S) load balancer enables traffic routing to the closest healthy backend cluster based on latency or geography, and automatically fails over to another region if one becomes unavailable. The global external backend configuration allows the load balancer to distribute traffic across multiple regional GKE clusters, providing both proximity-based routing and high availability.

Answer

Use a global external HTTP(S) load balancer with a single backend service pointing to one regional cluster.

Answer

Use Cloud CDN in front of a single regional GKE cluster to cache content.

Answer

Use a single regional GKE cluster with auto-scaling across zones.

Question 2

A large enterprise is migrating their on-premises data center to Google Cloud. They have hundreds of VMs and need to minimize network latency between on-prem and cloud during migration. They have high bandwidth requirements. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, high-bandwidth, low-latency connection between on-premises data centers and Google Cloud, bypassing the public internet. This is ideal for large-scale migrations with hundreds of VMs where minimizing latency and ensuring consistent throughput is critical.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Peering with Google

Question 3

An organization needs to encrypt data at rest in BigQuery using keys that are rotated every 90 days. They want to manage the keys themselves but cannot store keys on-premises. Which encryption approach should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS. CMEK with Cloud KMS allows customers to manage their own keys (including rotation) while keys are stored in Google's Cloud KMS.

Answer

Default Google-managed encryption

Answer

Cloud HSM

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 4

A global e-commerce platform uses Cloud Spanner for product inventory and wants to reduce costs. They notice that read replicas are underutilized and that most queries are single-key reads. Which configuration change will reduce costs while maintaining availability?

Accepted Answer

Downgrade the instance to a smaller regional configuration with fewer nodes. For Spanner, read replicas are used for read-only workloads; if underutilized, reducing the number of read replicas can lower costs without affecting write availability. However, fine-grained instance configuration changes are not straightforward; the best option is to adjust the number of nodes or use a smaller instance class. But among options, choosing a smaller regional configuration (fewer nodes) is practical.

Answer

Use Cloud SQL for reads and Spanner for writes only

Answer

Switch to a multi-region configuration with witness nodes

Answer

Reduce the number of read replicas in the instance configuration

Question 5

A company runs a latency-sensitive web application on Compute Engine in us-east1. They want to improve response times for users in Europe and Asia without changing the application architecture. Which TWO actions should they take? (Choose 2.)

Accepted Answer

Enable Cloud CDN on the load balancer. Cloud CDN caches static content at edge locations globally, reducing latency for users worldwide. Placing a load balancer in multiple regions (multi-region load balancing with proximity-based routing) directs users to the nearest backend region. Using only us-west1 would still leave European users far away. Cloud Armor is for security, not performance. Spot VMs are for cost savings, not latency.

Answer

Use preemptible VMs to reduce cost

Answer

Deploy additional instances in us-west1

Answer

Use Cloud Armor to block high-latency requests

Question 6

An organization runs a Kubernetes cluster on GKE with cluster autoscaling enabled. They notice that pods are frequently in 'Pending' state due to insufficient CPU, but the cluster autoscaler does not add nodes quickly enough. What is the most likely cause?

Accepted Answer

The node pool has reached the maximum node count limit.. The cluster autoscaler cannot add new nodes if the node pool has already reached its maximum node count limit. This limit is configured at the node pool level in GKE, and once reached, the autoscaler will not scale up further, leaving pods in 'Pending' state due to insufficient CPU resources.

Answer

The cluster autoscaler is using the 'least-waste' expander.

Answer

The horizontal pod autoscaler (HPA) is misconfigured.

Answer

The pod disruption budget (PDB) is too restrictive.

Question 7

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using the pod's own identity, without managing long-lived credentials. They have created a Google service account (GSA) and a Kubernetes service account (KSA). What should they do to bind the KSA to the GSA?

Accepted Answer

Add an annotation to the KSA referencing the GSA, and grant the KSA the iam.workloadIdentityUser role on the GSA. Workload Identity allows you to configure a KSA to act as a GSA by adding an annotation to the KSA and granting the GSA the necessary IAM role. The GSA does not impersonate the KSA; the KSA impersonates the GSA. The annotation is set on the KSA, not the pod. The GSA does not need to be bound to the KSA via an IAM role on the KSA.

Answer

Create a service account key and mount it as a secret in the pod

Answer

Grant the GSA the roles/iam.serviceAccountUser role on the project

Answer

Add an annotation to the GSA referencing the KSA, and grant the KSA the iam.workloadIdentityUser role on the GSA

Question 8

A company uses Shared VPC. A project admin in a service project tries to create a subnet in the shared VPC network but receives a permission denied error. What is the most likely cause?

Accepted Answer

The service project admin lacks the compute.subnetworks.create permission on the host project.. In a Shared VPC architecture, subnet creation is a privileged operation that can only be performed by a user with the compute.subnetworks.create permission on the host project. The service project admin, by default, does not have this permission in the host project, which is why the permission denied error occurs. Granting this permission to the service project admin at the host project level would resolve the issue.

Answer

Only the Shared VPC host project admin can create subnets.

Answer

The Shared VPC is not enabled for the service project.

Answer

Subnets must be created in the service project, not the host project.

Question 9

A financial services company uses Cloud Storage to store sensitive transaction records. They need to ensure that objects cannot be deleted or overwritten for a retention period of 7 years, even by the bucket owner. Which feature should they enable?

Question 10

A company has a GKE cluster with Workload Identity enabled. A pod needs to access a BigQuery dataset in a different project. The team has created a service account in the pod's project and granted it BigQuery Data Viewer on the dataset. They also created an IAM policy binding between the Kubernetes service account and the Google service account. The pod still gets permission denied. What is missing?

Accepted Answer

The Google service account needs the iam.workloadIdentityUser role on itself. Workload Identity requires the Google service account to be granted the iam.workloadIdentityUser role on the Google service account itself, not just on the Kubernetes service account.

Answer

The Kubernetes service account needs the iam.workloadIdentityUser role

Answer

The pod needs a node pool with Workload Identity enabled

Answer

The BigQuery dataset must be in the same project as the cluster

Question 11

A company deploys a global application on Cloud Run and uses Cloud SQL for user data. They need sub-10ms read latency for frequently accessed user profiles across regions. Traffic is unpredictable but consistently high. The database must support strong consistency. Which approach meets these requirements?

Accepted Answer

Use Cloud Spanner with multi-region configuration. Cloud Spanner with a multi-region configuration is the only option that provides strong consistency, sub-10ms read latency, and automatic scaling for unpredictable, high traffic across regions. It uses synchronous replication with Paxos-based consensus to ensure globally consistent reads without sacrificing performance.

Answer

Use Cloud Bigtable with replication across regions

Answer

Use Cloud SQL with read replicas in each region and enable synchronous replication

Answer

Use Cloud SQL with cross-region replication and Memorystore cache in each region

Question 12

Refer to the exhibit. The SLO for the payments-api service is 99.9% availability over 30 days. The current compliance is 99.89% and the error budget is exhausted. Which action should the SRE team take FIRST?

Accepted Answer

Pause all non-critical deployments and investigate the cause of the increased error rate.. The error budget is exhausted, meaning the service has already consumed its allowed downtime for the 30-day window. The immediate priority is to stop further budget erosion by pausing non-critical deployments and investigating the root cause of the increased error rate. This aligns with SRE best practices: when the error budget is depleted, the team should shift focus from feature velocity to reliability, halting all non-essential changes until the cause is understood and mitigated.

Answer

Increase the SLO target to 99.99% to reduce future burn rate.

Answer

Trigger a rollback of the latest deployment to stabilize the service.

Answer

Scale up the service to handle more traffic and reduce error rate.

Question 13

Your company runs a production application on Compute Engine instances behind a managed instance group (MIG). You need to perform a rolling update with canary testing, gradually shifting traffic to the new version only if performance metrics are healthy. Which approach should you use?

Accepted Answer

Use Cloud Deploy with a deployment strategy that includes a canary phase and automated verification. Cloud Deploy can be used to orchestrate canary deployments on Compute Engine. However, a more direct approach is to use a MIG with a canary configuration: you can update the MIG's instance template and use a new MIG for the canary version, then adjust the load balancer's backend weights to shift traffic gradually. Cloud Deploy supports this with deployment strategies.

Answer

Create a new MIG with the new template and use a Cloud Load Balancer's traffic splitting

Answer

Manually update each instance by SSH'ing and running a script

Answer

Use gcloud compute instance-groups managed rolling-action start-update with a maxSurge of 0

Question 14

A company runs an e-commerce platform on Google Cloud. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster (us-central1, three zones). The frontend service is exposed via an HTTP Load Balancer with Cloud CDN. Recently, during a flash sale, users experienced high latency and occasional 502 errors. The backend service is a Java application that reads from Cloud Spanner. The team has observed that Spanner CPU utilization averaged 65% during the sale, with a few spikes to 80%. The number of frontend pods was auto-scaled to 50, each running on n1-standard-2 nodes. The node pool is set to autoscale up to 100 nodes. The errors appear to correlate with periods of high CPU on the nodes, but not always. What is the most likely cause and recommended action?

Accepted Answer

Change the backend service to use a multi-zone NEG that includes endpoints from all three zones, and ensure the load balancer is configured for cross-zone load balancing.. The high latency and 502 errors are likely caused by the HTTP Load Balancer sending requests to unhealthy backend pods due to zone-imbalanced traffic. A regional GKE cluster with a multi-zone NEG and cross-zone load balancing ensures that the load balancer distributes requests evenly across all pods in all three zones, preventing node CPU spikes in a single zone from causing errors. Option B directly addresses this by enabling proper traffic distribution, which is the most probable root cause given that node CPU spikes correlate with errors but not always.

Answer

Scale up the Cloud Spanner instance to handle higher peak CPU, as the 80% spikes indicate insufficient capacity.

Answer

Increase the CPU request for the frontend pods and set a higher target CPU utilization for the Horizontal Pod Autoscaler.

Answer

Increase the health check interval and timeout settings to give pods more time to respond before being marked unhealthy.

Question 15

A Cloud Router BGP session is flapping. The logs show 'Interface flapping due to changes in the underlying network'. What is the most likely cause?

Accepted Answer

MTU mismatch across the network path.. The log message 'Interface flapping due to changes in the underlying network' indicates that the BGP session is unstable because the physical or logical interface is going up and down. An MTU mismatch across the network path can cause packet fragmentation issues, leading to intermittent connectivity and interface flaps as the router detects and recovers from the problem. This is the most likely cause because it directly affects the stability of the underlying network path.

Answer

BGP MD5 authentication failure.

Answer

Incorrect local AS number in Cloud Router configuration.

Answer

BGP timer misconfiguration between peers.

Question 16

A startup is designing a real-time leaderboard for a multiplayer game. The leaderboard must update within seconds of a score change and handle millions of concurrent players. Strong consistency is not required, but availability is critical. Which database is most suitable?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is optimized for high-throughput, low-latency reads and writes, and can serve as a leaderboard backend if row keys are designed properly. It offers eventual consistency, which is acceptable here. Cloud Spanner provides strong consistency but is more expensive and may have higher latency. Firestore is good for real-time updates but may not handle millions of concurrent updates easily. Memorystore (Redis) can also do leaderboards but is not a database for persistent storage; it's a cache.

Answer

Cloud Memorystore

Answer

Cloud Spanner

Answer

Cloud Firestore

Question 17

An organization uses Cloud SQL for MySQL in a production environment. They need to ensure high availability with automatic failover in case of a zonal failure. Which configuration should they use?

Accepted Answer

Create a regional Cloud SQL instance with automatic failover.. A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

Answer

Create a read replica in a different region.

Answer

Export the database daily and import into a new instance if failure occurs.

Answer

Deploy Cloud SQL across multiple regions using cross-region replication.

Question 18

You are responsible for incident management for a production service. You want to reduce manual toil during the initial response to common issues like high latency. What is the best approach?

Accepted Answer

Use Cloud Monitoring to trigger a Cloud Function that performs automated checks and rolls back the last deployment if latency spikes.. It directly reduces manual toil by automating the initial response to common issues like high latency. Cloud Monitoring triggers a Cloud Function that performs automated checks and, if latency spikes, rolls back the last deployment, eliminating the need for human intervention during the critical first response phase.

Answer

Set up Cloud Monitoring alerts with email notifications to the on-call engineer.

Answer

Create detailed runbooks and require the on-call to follow them step by step.

Answer

Enable Cloud Logging and set up a custom dashboard for the on-call.

Question 19

Your company runs a critical application on Google Kubernetes Engine (GKE) in us-central1. The application consists of a frontend deployment with 3 replicas and a backend statefulset with 5 replicas using persistent volumes (SSD). Recently, the team noticed that during a regional outage in us-central1, the application became completely unavailable. They want to design a multi-region architecture that can survive a regional failure with RPO of 1 hour and RTO of 30 minutes. The application is stateless on the frontend but the backend stores critical data on persistent disks. The backend can operate in a read-only mode from a secondary region if needed. They have a limited budget and want to minimize ongoing costs. Which approach should they take?

Accepted Answer

Deploy the frontend and backend in a regional GKE cluster across us-central1, and use a CronJob to take snapshots of persistent volumes every hour and copy them to a secondary region. In disaster, restore the snapshots to a new cluster in the secondary region.. Meets the RPO of 1 hour by using a CronJob to take hourly snapshots of PersistentVolume data and copy them to a secondary region. In a disaster, you restore those snapshots to a new GKE cluster in the secondary region, achieving an RTO of 30 minutes by automating the restore process. This approach minimizes ongoing costs because snapshots are incremental and you only pay for storage in the secondary region when needed, while the frontend remains stateless and can be redeployed quickly.

Answer

Migrate the backend to Cloud SQL for MySQL with cross-region replication, and keep the frontend on GKE with multi-region ingress.

Answer

Deploy the frontend and backend in a regional GKE cluster and use regional persistent disks for the statefulset, replicating data synchronously across zones.

Answer

Deploy the frontend and backend in a single zonal cluster in us-central1-a, and use scheduled snapshots of persistent disks to a different region.

Question 20

A team is designing a disaster recovery (DR) plan for a critical application. Which THREE components are essential for a robust DR plan? (Choose 3)

Accepted Answer

Failover procedures and runbooks. Failover procedures and runbooks (A) are essential because they provide step-by-step instructions for executing a controlled transition to the secondary site, ensuring minimal downtime and consistent recovery actions. Without documented runbooks, teams risk misconfigurations during a disaster, which can extend recovery time objectives (RTO) beyond acceptable limits.

Answer

A single-region deployment for consistency

Answer

Load testing to validate performance