Google PCA Manage implementation of cloud architecture — 20 Questions

Question 1

An organization is running a stateful workload on Compute Engine with a single persistent disk. They want to migrate to a regional persistent disk for higher availability. The disk is 500 GB and currently 80% full. They need zero downtime during the migration. What is the recommended approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a snapshot of the disk, then create a new regional persistent disk from that snapshot, and attach it to the instance.. Creating a snapshot of the existing persistent disk and then creating a new regional persistent disk from that snapshot allows you to attach the new disk to the instance with zero downtime. The snapshot captures the disk state at a point in time, and the regional disk is created asynchronously; once available, you can detach the original disk and attach the regional disk without stopping the instance, as Compute Engine supports live disk attachment/detachment.

Answer

Attach a new regional disk to the instance and use RAID 1 mirroring.

Answer

Use rsync to copy data to a new regional disk while the instance is running.

Answer

Use gcloud compute disks resize to change the disk type to regional.

Question 2

You are designing a CI/CD pipeline for a containerized application on Google Cloud. The application is built with Cloud Build, stored in Container Registry, and deployed to GKE. The team wants to ensure that only images that pass vulnerability scanning are deployed. What should you do?

Accepted Answer

Add a step in Cloud Build that runs a vulnerability scanner on the image and fails the build if vulnerabilities exceed a threshold.. Cloud Build can include a custom step that runs a vulnerability scanner (e.g., using the Google Cloud `gcloud container images list-tags` with the `--show-occurrences-from` flag or a third-party tool like Trivy) and then evaluates the results against a threshold. If the scan finds vulnerabilities exceeding the defined threshold, the build step exits with a non-zero status, causing the Cloud Build pipeline to fail and preventing the image from being pushed to Container Registry or deployed. This directly enforces the requirement that only images passing vulnerability scanning proceed in the CI/CD pipeline.

Answer

Configure Container Analysis to automatically scan images in Container Registry and block deployment via a webhook.

Answer

Enable Binary Authorization on the GKE cluster and configure a policy to require an attestation from a trusted authority.

Answer

Use Security Command Center to detect vulnerabilities and alert the team to manually block deployments.

Question 3

A company runs a data analytics platform on Google Cloud using BigQuery, Dataflow, and Cloud Storage. They notice that Dataflow jobs are failing with 'out of memory' errors for certain large pipelines. The pipelines process variable amounts of data, sometimes spiking 10x normal. Which strategy should they use to handle these spikes cost-effectively?

Accepted Answer

Configure the Dataflow pipeline to use autoscaling with a higher maximum number of workers and use preemptible VMs for cost savings.. Dataflow's autoscaling can dynamically add workers to handle sudden data spikes, and using preemptible VMs significantly reduces cost for batch pipelines that can tolerate interruptions. This approach avoids manual intervention and over-provisioning, making it cost-effective for variable workloads.

Answer

Manually monitor the job and increase the number of workers when a spike is detected.

Answer

Increase the machine type of the workers to a high-memory type and disable autoscaling.

Answer

Use Dataflow Streaming Engine to offload state to persistent storage and reduce memory usage.

Question 4

Which TWO statements are true about Google Cloud HTTPS Load Balancers?

Accepted Answer

They can forward traffic to backends in multiple regions, including instances in different VPC networks.. Google Cloud HTTPS Load Balancers are global external load balancers that can distribute traffic to backends across multiple regions, and they support cross-VPC connectivity via Shared VPC or VPC Network Peering, allowing instances in different VPC networks to serve as backends.

Answer

They support only external backends, such as internet-facing instances.

Answer

They support only IPv4 traffic.

Answer

They can be used to load balance internal HTTP(S) traffic within a VPC.

Question 5

You are reviewing an IAM policy for a Cloud Storage bucket. Alice is a member of the data-team group. What level of access does Alice have to objects in this bucket?

Accepted Answer

Read and write access (admin).. The IAM policy grants the data-team group the roles/storage.objectAdmin role, which provides full read, write, and delete access to objects in the bucket. Alice, as a member of the data-team group, inherits this role and therefore has read and write (admin) access to the objects.

Answer

Read-only access.

Answer

No access, because the group policy overrides the individual policy.

Answer

Write-only access.

Question 6

Your company runs a critical application on Google Kubernetes Engine (GKE) in us-central1. The application consists of a frontend deployment with 3 replicas and a backend statefulset with 5 replicas using persistent volumes (SSD). Recently, the team noticed that during a regional outage in us-central1, the application became completely unavailable. They want to design a multi-region architecture that can survive a regional failure with RPO of 1 hour and RTO of 30 minutes. The application is stateless on the frontend but the backend stores critical data on persistent disks. The backend can operate in a read-only mode from a secondary region if needed. They have a limited budget and want to minimize ongoing costs. Which approach should they take?

Accepted Answer

Deploy the frontend and backend in a regional GKE cluster across us-central1, and use a CronJob to take snapshots of persistent volumes every hour and copy them to a secondary region. In disaster, restore the snapshots to a new cluster in the secondary region.. Meets the RPO of 1 hour by using a CronJob to take hourly snapshots of PersistentVolume data and copy them to a secondary region. In a disaster, you restore those snapshots to a new GKE cluster in the secondary region, achieving an RTO of 30 minutes by automating the restore process. This approach minimizes ongoing costs because snapshots are incremental and you only pay for storage in the secondary region when needed, while the frontend remains stateless and can be redeployed quickly.

Answer

Migrate the backend to Cloud SQL for MySQL with cross-region replication, and keep the frontend on GKE with multi-region ingress.

Answer

Deploy the frontend and backend in a regional GKE cluster and use regional persistent disks for the statefulset, replicating data synchronously across zones.

Answer

Deploy the frontend and backend in a single zonal cluster in us-central1-a, and use scheduled snapshots of persistent disks to a different region.

Question 7

An organization has deployed a multi-region Cloud Spanner instance for a global application. The application is experiencing high latency for read requests from a specific region. The team has verified that the application is using stale reads and the data distribution is even. What is the most likely cause of the high latency?

Accepted Answer

The Spanner instance does not have a read replica in a location close to the clients.. Cloud Spanner uses a single global configuration with regional read replicas. If the instance does not have a read replica in the region where the clients are located, read requests must traverse the network to a replica in another region, causing higher latency. Even with stale reads, the physical distance to the nearest replica directly impacts read latency.

Answer

The number of read replicas in the region is insufficient to handle the read volume.

Answer

The Spanner instance has too few nodes, causing contention.

Answer

The application is using read-write transactions instead of read-only transactions.

Question 8

A company is designing a disaster recovery plan for a critical application running on Compute Engine. The application uses a PostgreSQL database and stores files on persistent disks. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. Which two actions should the company take?

Accepted Answer

Configure PostgreSQL replication to a standby instance in another region.. Option C is correct because configuring PostgreSQL replication to a standby instance in another region provides continuous, near-real-time data synchronization, which easily satisfies the 1-hour RPO and enables a fast failover that fits within the 4-hour RTO. Option E is correct because snapshot replication copies persistent disk snapshots to another region, ensuring that the application's file data on persistent disks is available off-region for recovery within the RTO and RPO targets. Option A is not sufficient on its own because an instance template only defines VM configuration, not the application data or database state needed for recovery. Option B is inadequate because storing hourly snapshots in the same region does not protect against a regional outage, which is the core of a disaster recovery plan. Option D is not appropriate because daily backups to another region yield an RPO of up to 24 hours, which exceeds the required 1-hour RPO.

Answer

Create an instance template for the application and store it in Cloud Storage.

Answer

Take hourly persistent disk snapshots and store them in the same region.

Answer

Use Cloud Storage to store database backups and transfer them to a different region daily.

Question 9

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the cluster can automatically scale based on custom metrics, such as the number of pending requests per pod. Which two steps should they take? (Choose TWO)

Accepted Answer

Deploy the Metrics Server in the cluster to expose custom metrics via the Custom Metrics API.. Option A is correct because the Metrics Server (or a custom metrics adapter) is required to expose custom metrics through the Custom Metrics API so the HPA can consume them; without this API, the HPA cannot read custom metrics. Option B is correct because the application must actually emit the custom metric (e.g., pending requests per pod) via an endpoint, and the HPA must be configured to reference that specific custom metric for scaling decisions. Option C is incorrect because Cloud Monitoring dashboards are for visualization, not for feeding the HPA's custom metrics API. Option D is incorrect because targeting average CPU utilization uses the resource metrics API, not custom metrics like pending requests. Option E is incorrect because GKE Autopilot manages node scaling and pod resource requests but does not automatically configure HPA custom metrics scaling.

Answer

Enable the Cloud Monitoring API and create a custom dashboard to track pending requests.

Answer

Configure a HorizontalPodAutoscaler (HPA) with the target average CPU utilization set to 80%.

Answer

Enable GKE Autopilot mode to automatically manage scaling based on custom metrics.

Question 10

A developer runs the command above and sees the output. The cluster has one node pool with 3 nodes, each of type e2-standard-4 (4 vCPU, 16 GB RAM). The application requires at least 2 GB of memory per pod and the cluster has 10 pods that need to be scheduled. The developer also notices that the node pool autoscaling is enabled with a minimum of 1 and maximum of 5 nodes. However, the cluster is unable to schedule all pods. What is the most likely cause?

Accepted Answer

The pod resource requests exceed the allocatable resources on the existing nodes after accounting for system reservations.. The cluster has 3 e2-standard-4 nodes, each with 4 vCPU and 16 GB RAM. After accounting for system reservations (e.g., kubelet, OS, daemonsets), the allocatable memory per node is typically around 13-14 GB. With 10 pods each requesting 2 GB, the total memory request is 20 GB, but the total allocatable memory across 3 nodes is only about 39-42 GB. However, the autoscaler can only scale up to 5 nodes, and even then, the total allocatable memory would be around 65-70 GB, which is sufficient. The most likely cause is that the pod resource requests exceed the allocatable resources on the existing nodes, preventing scheduling, and the autoscaler may not have triggered yet or is constrained by other factors like CPU or node limits.

Answer

The cluster is running an older version of Kubernetes that does not support node auto-scaling.

Answer

The node pool autoscaler is not properly configured to scale up based on pod resource requests.

Answer

The node auto-repair feature is disabled, causing a node to be unhealthy.

Question 11

A large e-commerce company runs a multi-tier application on Google Cloud. The frontend is served by a global HTTP Load Balancer with a backend service pointing to a managed instance group (MIG) of nginx web servers. The application tier consists of a regional internal TCP/UDP load balancer distributing traffic to a MIG of Java application servers. The database tier uses Cloud SQL for PostgreSQL in a failover replica configuration. The architecture is deployed in the us-central1 region across three zones. Recently, the operations team noticed intermittent 502 Bad Gateway errors from the frontend load balancer during peak traffic hours. The errors last for a few minutes and then recover. The team suspects the application tier is overwhelmed. They need to implement a solution that can handle traffic spikes without manual intervention. Which course of action should they take?

Accepted Answer

Configure HTTP health checks on the regional internal load balancer and set the autoscaler to use the 'HTTP load balancing utilization' metric for the application tier MIG.. The intermittent 502 errors during peak traffic indicate that the application tier MIG is being overwhelmed. By configuring HTTP health checks on the regional internal load balancer and setting the autoscaler to use the 'HTTP load balancing utilization' metric, the autoscaler can scale the application tier MIG based on the actual load distribution from the internal load balancer, ensuring it handles traffic spikes without manual intervention. This directly addresses the root cause—insufficient application instances—by enabling dynamic scaling based on real-time utilization.

Answer

Increase the maximum number of instances in the application tier MIG from 10 to 20.

Answer

Enable Cloud Armor on the frontend load balancer with a rate-limiting rule to block excessive traffic.

Answer

Enable Cloud CDN on the frontend load balancer to cache static assets and reduce load on the application tier.

Question 12

An organization has a multi-regional deployment of a stateful application on GKE using regional persistent disks. They need to implement disaster recovery with an RPO of less than 1 hour and RTO of 30 minutes. What is the most cost-effective approach?

Accepted Answer

Use regional persistent disks with asynchronous replication to a secondary region and deploy GKE clusters in both regions with a load balancer directing traffic.. Regional persistent disks with asynchronous replication provide built-in, managed replication to a secondary region, meeting the RPO of less than 1 hour and RTO of 30 minutes without additional infrastructure costs. By deploying GKE clusters in both regions and using a load balancer, traffic can be redirected to the secondary cluster within the RTO, making this the most cost-effective approach as it avoids third-party tools or complex manual processes.

Answer

Use zonal persistent disks and take snapshots every 45 minutes, then restore in secondary region.

Answer

Use a third-party replication tool to asynchronously replicate data to the secondary region.

Answer

Use Cloud Storage FUSE to write state to a multi-regional bucket and read from secondary cluster.

Question 13

A DevOps team is building a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine. They want to ensure that each microservice can be deployed independently without affecting other services. Which strategy should they use?

Accepted Answer

Implement canary deployments with a service mesh such as Istio and use separate Cloud Build triggers per microservice.. It combines canary deployments with a service mesh (Istio) to gradually shift traffic to a new version of a single microservice, ensuring independent deployment without impacting other services. Separate Cloud Build triggers per microservice allow each service to be built and deployed independently, aligning with the microservices architecture's requirement for decoupled release cycles.

Answer

Use blue/green deployments with a global load balancer to switch traffic.

Answer

Use Cloud Deploy with rollout strategies and keep all microservices in the same GKE namespace.

Answer

Create a single monolithic pipeline that deploys all microservices simultaneously.

Question 14

An organization needs to connect an on-premises data center to Google Cloud using Dedicated Interconnect with a 10 Gbps link. They require high availability and want to achieve 99.99% SLA. What is the minimum number of VLAN attachments and Interconnect connections needed?

Accepted Answer

Two Interconnect connections, each with one VLAN attachment.. To achieve 99.99% SLA with Dedicated Interconnect, you need two separate Interconnect connections (for physical diversity) and each connection must have at least one VLAN attachment. The SLA requires redundant paths; a single Interconnect connection, even with multiple VLAN attachments, does not provide physical diversity and thus cannot meet the 99.99% uptime target.

Answer

One Interconnect connection with two VLAN attachments.

Answer

Four Interconnect connections with one VLAN attachment each.

Answer

Two Interconnect connections, each with two VLAN attachments.

Question 15

A company is using Cloud Armor with HTTP Load Balancing to protect a web application. They want to block traffic from specific IP ranges for all requests except those that include a valid reCAPTCHA token. Which Cloud Armor rule configuration should they use?

Accepted Answer

Create a deny rule for the IP ranges with a condition that the request does not contain a valid reCAPTCHA token.. Cloud Armor security rules support boolean conditions using operators like `request.path` or custom headers. By creating a deny rule for the specific IP ranges with a condition that the request does not contain a valid reCAPTCHA token (evaluated via the `hasRecaptchaToken()` function), you allow traffic from those IPs only when the token is present. This directly implements the requirement without affecting other traffic.

Answer

Use a rate-based rule to limit requests from those IP ranges and add a reCAPTCHA action.

Answer

Create a whitelist rule for the IP ranges and attach it as a deny rule with higher priority.

Answer

Use Identity-Aware Proxy (IAP) to block the IPs and reCAPTCHA for others.

Question 16

Which TWO statements about Google Cloud VPC firewall rules are correct? (Choose two.)

Accepted Answer

Firewall rules allow you to specify both source and destination IP ranges.. Option B is correct because Google Cloud VPC firewall rules let you define both a source (via sourceRanges or sourceTags/sourceServiceAccounts) and a destination (via destinationRanges or targetTags/targetServiceAccounts), enabling granular control over traffic between specific IP ranges. Option E is correct because hierarchical firewall policies are a distinct resource that can be attached at the organization, folder, or project node in the resource hierarchy, and they are evaluated before VPC firewall rules. Option A is wrong because VPC firewall rules are stateful — return traffic for allowed connections is automatically permitted, so no explicit return rule is needed. Option C is wrong because the default VPC comes with implied rules that allow all ingress from within the VPC and allow egress to all destinations, plus predefined rules like default-allow-internal, default-allow-ssh, and default-allow-icmp; it does not block all ingress. Option D is wrong because firewall rules can target or source instances by service account using targetServiceAccounts and sourceServiceAccounts.

Answer

Firewall rules are stateless and require explicit rules for return traffic.

Answer

Default VPC has firewall rules that block all ingress traffic.

Answer

Firewall rules cannot be applied to instances by service account.

Question 17

Which TWO methods can be used to provide secure access to a private Google Kubernetes Engine (GKE) cluster from the internet? (Choose two.)

Accepted Answer

Use Cloud VPN to connect from an on-premises network that has internet access.. Option C is correct because a private GKE cluster's control plane only has an internal endpoint, so a Cloud VPN tunnel (or Cloud Interconnect) from an on-premises network that itself has internet access provides a secure, encrypted path to reach the master without exposing it publicly. Option E is correct because IAP with TCP forwarding lets authorized users tunnel to the private master endpoint over HTTPS through Google's infrastructure, enforcing IAM-based access control without assigning a public IP. Option A is wrong because an internal load balancer only exposes workloads to internal VPC clients, not to the internet. Option B is wrong because Cloud NAT provides outbound-only translation for private instances and does not accept inbound connections from the internet. Option D is wrong because assigning a public IP to the master endpoint removes the private-cluster isolation and exposes the control plane directly to the internet, which is not a secure access method.

Answer

Expose the cluster via an internal load balancer.

Answer

Configure a Cloud NAT to allow inbound connections from the internet.

Answer

Assign a public IP address to the cluster master endpoint.

Question 18

What is the most likely reason the NetworkPolicy is not taking effect?

Accepted Answer

The developer used the networking.k8s.io/v1 API version instead of the Calico CRD projectcalico.org/v3.. The NetworkPolicy is not taking effect because the developer used the standard Kubernetes API version `networking.k8s.io/v1`, which defines a different schema and behavior than the Calico CRD `projectcalico.org/v3`. Calico NetworkPolicies support advanced features like order-of-precedence, global policies, and non-IP match criteria that are not available in the native Kubernetes NetworkPolicy API. When a Calico-specific policy is defined using the wrong API version, the cluster's policy engine (Calico) ignores it, resulting in no enforcement.

Answer

The cluster has a global network policy that overrides per-namespace policies.

Answer

The pod labels do not match because of a capitalization mismatch.

Answer

The NetworkPolicy is missing a spec.podSelector.matchLabels entry.

Question 19

Why did the VM resource fail while the disk succeeded?

Accepted Answer

The VM definition is missing a boot disk source reference.. When you define a VM instance in Google Cloud, you must include a reference to a boot disk source. If the `source` field under `disks` is missing or empty, the API will reject the VM creation but may still succeed in creating the disk resource separately, since the disk creation does not depend on the VM. This explains why the disk succeeded while the VM failed.

Answer

The disk and VM must be in the same zone; us-central1-a is consistent.

Answer

The VM's machine type is not available in us-central1-a.

Answer

The VM's network is misspelled as 'global/networks/default' instead of 'global/networks/default' (correct).

Question 20

A company has a requirement to store application logs for 7 years for compliance. They are using Cloud Logging. What is the most cost-effective way to retain logs?

Accepted Answer

Export logs to Cloud Storage with Object Lifecycle management to delete after 7 years. Cloud Logging's default retention is limited (e.g., 30 days for logs in the default _Default bucket, and up to 365 days for custom log buckets). To meet a 7-year compliance requirement cost-effectively, you should export logs to Cloud Storage and use Object Lifecycle Management to delete objects after 7 years. Cloud Storage offers lower long-term storage costs than retaining logs in Logging's _Required or custom buckets, and lifecycle rules automate deletion without ongoing compute costs.

Answer

Set the log bucket retention to 7 years

Answer

Export logs to BigQuery and run scheduled queries to delete old data

Answer

Use Cloud Logging's default retention and rely on backups