Google PCA Manage implementation of cloud architecture — 25 Questions

Question 1

Which TWO of the following are valid methods to securely access Google Cloud APIs from a Compute Engine instance without managing service account keys?

Accepted Answer

Attach a custom service account to the instance using the gcloud command. The correct options are B and E because both leverage the instance metadata server to provide credentials without managing service account keys. Option B (attaching a custom service account via gcloud) assigns an identity to the instance, while Option E (using the default Compute Engine service account) uses the pre-configured default identity. Option A requires downloading and managing a key file, which is insecure. Option C (granting IAM roles) is about permissions, not access method. Option D (using Cloud KMS) is for encrypting keys, not for API access.

Answer

Download a service account key file and store it on the instance

Answer

Grant the appropriate IAM roles to the instance's service account

Answer

Use a Cloud KMS key to generate temporary credentials

Question 2

An organization has two Google Cloud projects: Project A hosts a Compute Engine instance with a MySQL database, and Project B hosts an application that needs to connect to the database. The network team set up VPC peering between the two VPCs. The application cannot connect to the database on port 3306. The database instance has a private IP. The network team has verified that firewall rules in both VPCs allow traffic from Project B's subnets to the database IP on port 3306. Ping from the application instance to the database IP succeeds. What should the architect do to resolve the connectivity issue?

Accepted Answer

Configure custom routes export on the VPC peering connection in the database project (Project A).. Since ping succeeds, routing for ICMP is functional, but TCP on port 3306 fails. This indicates that the issue is not with VPC peering route exchange (which includes subnet routes like the database’s private IP). The problem likely lies with the database not listening on the private IP (e.g., bound to localhost) or a host-level firewall. Option A checks for overlapping subnets, which is a prerequisite and already satisfied. Therefore, option C is not the correct fix.

Answer

Ensure that the VPC peering is established and that the subnet ranges do not overlap.

Answer

Configure Cloud NAT in Project B to enable outbound connections.

Answer

Set up a Cloud VPN tunnel between the two projects instead.

Question 3

Your team has deployed a microservices application on Google Kubernetes Engine (GKE) with multiple services communicating via internal ClusterIP services. You notice that some requests between services are failing intermittently with 'connection refused' errors. The services are defined with readiness probes. What is the most likely cause?

Accepted Answer

The readiness probes are not passing, causing the service endpoints to be removed.. The 'connection refused' error indicates that the client is attempting to connect to a port on which no process is listening. In GKE, when a readiness probe fails, Kubernetes removes the pod's IP from the corresponding ClusterIP service's endpoints. If all pods for a service fail their readiness probes, the service has no healthy endpoints, and any request to the ClusterIP will be refused because there is no backend to accept the connection. This matches the intermittent nature of the issue, as pods may temporarily fail the probe and then recover.

Answer

The services are not exposed via a VPC peering connection to the client's VPC.

Answer

The services are using NodePort instead of LoadBalancer type, causing port conflicts.

Answer

The services are not associated with an Ingress resource.

Question 4

An organization is running a stateful workload on Compute Engine with a single persistent disk. They want to migrate to a regional persistent disk for higher availability. The disk is 500 GB and currently 80% full. They need zero downtime during the migration. What is the recommended approach?

Accepted Answer

Create a snapshot of the disk, then create a new regional persistent disk from that snapshot, and attach it to the instance.. Creating a snapshot of the existing persistent disk and then creating a new regional persistent disk from that snapshot allows you to attach the new disk to the instance with zero downtime. The snapshot captures the disk state at a point in time, and the regional disk is created asynchronously; once available, you can detach the original disk and attach the regional disk without stopping the instance, as Compute Engine supports live disk attachment/detachment.

Answer

Attach a new regional disk to the instance and use RAID 1 mirroring.

Answer

Use rsync to copy data to a new regional disk while the instance is running.

Answer

Use gcloud compute disks resize to change the disk type to regional.

Question 5

A company is planning to deploy a global web application on Google Cloud. They expect low latency for users worldwide and need to serve static content (images, CSS) as well as dynamic API responses. Which architecture should they use?

Accepted Answer

Use Cloud CDN in front of an external HTTPS Load Balancer with backend services in multiple regions.. Cloud CDN in front of an external HTTPS Load Balancer with backend services in multiple regions is correct because it provides global anycast IP termination, low-latency content delivery via Google's edge cache for static content, and dynamic API requests are forwarded to the nearest healthy backend in the closest region. This architecture meets both the low-latency requirement for users worldwide and the need to serve both static and dynamic content efficiently.

Answer

Use Cloud NAT to allow egress traffic from instances and distribute static content via a shared VPC.

Answer

Use Cloud DNS with geo-routing to direct users to the closest regional Cloud Run service.

Answer

Use VPC Network Peering to connect multiple regional VPCs and serve content from a central location.

Question 6

You are designing a CI/CD pipeline for a containerized application on Google Cloud. The application is built with Cloud Build, stored in Container Registry, and deployed to GKE. The team wants to ensure that only images that pass vulnerability scanning are deployed. What should you do?

Accepted Answer

Add a step in Cloud Build that runs a vulnerability scanner on the image and fails the build if vulnerabilities exceed a threshold.. Cloud Build can include a custom step that runs a vulnerability scanner (e.g., using the Google Cloud `gcloud container images list-tags` with the `--show-occurrences-from` flag or a third-party tool like Trivy) and then evaluates the results against a threshold. If the scan finds vulnerabilities exceeding the defined threshold, the build step exits with a non-zero status, causing the Cloud Build pipeline to fail and preventing the image from being pushed to Container Registry or deployed. This directly enforces the requirement that only images passing vulnerability scanning proceed in the CI/CD pipeline.

Answer

Configure Container Analysis to automatically scan images in Container Registry and block deployment via a webhook.

Answer

Enable Binary Authorization on the GKE cluster and configure a policy to require an attestation from a trusted authority.

Answer

Use Security Command Center to detect vulnerabilities and alert the team to manually block deployments.

Question 7

A company runs a data analytics platform on Google Cloud using BigQuery, Dataflow, and Cloud Storage. They notice that Dataflow jobs are failing with 'out of memory' errors for certain large pipelines. The pipelines process variable amounts of data, sometimes spiking 10x normal. Which strategy should they use to handle these spikes cost-effectively?

Accepted Answer

Configure the Dataflow pipeline to use autoscaling with a higher maximum number of workers and use preemptible VMs for cost savings.. Dataflow's autoscaling can dynamically add workers to handle sudden data spikes, and using preemptible VMs significantly reduces cost for batch pipelines that can tolerate interruptions. This approach avoids manual intervention and over-provisioning, making it cost-effective for variable workloads.

Answer

Manually monitor the job and increase the number of workers when a spike is detected.

Answer

Increase the machine type of the workers to a high-memory type and disable autoscaling.

Answer

Use Dataflow Streaming Engine to offload state to persistent storage and reduce memory usage.

Question 8

A startup wants to deploy a web application on Google Cloud with a MySQL database. They anticipate low traffic initially but want the ability to scale seamlessly. They also want to minimize operational overhead. Which combination of services should they choose?

Accepted Answer

App Engine Standard Environment with Cloud SQL.. App Engine Standard Environment provides a fully managed, autoscaling platform for web applications, while Cloud SQL offers a managed MySQL database with automatic replication and backups. This combination minimizes operational overhead because Google handles infrastructure provisioning, patching, and scaling, and Cloud SQL integrates natively with App Engine via the Cloud SQL proxy or Unix socket, requiring no manual configuration for connectivity.

Answer

Compute Engine with a self-managed MySQL instance.

Answer

Cloud Run with Cloud Spanner.

Answer

Google Kubernetes Engine (GKE) with Cloud SQL.

Question 9

Your organization has a policy that all Compute Engine instances must have specific labels (env, team, cost-center) applied. You want to enforce this automatically when instances are created. What should you do?

Accepted Answer

Use the Organization Policy service with a custom constraint to require labels on Compute Engine instances.. Organization Policy Service with a custom constraint allows you to enforce that all Compute Engine instances must have specific labels (env, team, cost-center) at creation time. This is a preventive control that blocks creation of non-compliant instances, unlike reactive or permission-based approaches. Custom constraints use the `compute.googleapis.com/instance` resource type and can require label keys or values using CEL (Common Expression Language) syntax.

Answer

Enable Cloud Audit Logs and set up a metric-based alert to detect instances without labels.

Answer

Create a Cloud Function that listens for instance creation events and adds labels automatically.

Answer

Assign a custom IAM role that includes permission to label instances, and remove the default compute.instances.create permission.

Question 10

Which TWO statements are true about Google Cloud HTTPS Load Balancers?

Accepted Answer

They can forward traffic to backends in multiple regions, including instances in different VPC networks.. Google Cloud HTTPS Load Balancers are global external load balancers that can distribute traffic to backends across multiple regions, and they support cross-VPC connectivity via Shared VPC or VPC Network Peering, allowing instances in different VPC networks to serve as backends.

Answer

They support only external backends, such as internet-facing instances.

Answer

They support only IPv4 traffic.

Answer

They can be used to load balance internal HTTP(S) traffic within a VPC.

Question 11

Which THREE actions can help reduce costs for a BigQuery workload that runs frequent, ad-hoc analytical queries on a large dataset?

Accepted Answer

Partition the table by a date or timestamp column.. Partitioning the table by a date or timestamp column (Option B) reduces the amount of data scanned by BigQuery for queries that filter on that column, directly lowering query costs (pay-per-byte model). It also improves performance by pruning irrelevant partitions, making it a core cost-saving technique for ad-hoc analytical workloads.

Answer

Enable automatic schema detection to avoid manual schema definition.

Answer

Use flat-rate pricing with reserved slots.

Question 12

An engineer runs the command above. A few days later, the instance becomes unresponsive. Upon investigation, you find that the boot disk is 100 GB and 95% full. The data disk is 500 GB and only 20% full. What is the most likely cause of the unresponsiveness?

Accepted Answer

The boot disk is too small and has run out of space.. The boot disk is 95% full, which leaves insufficient free space for the operating system to write temporary files, logs, or perform essential system operations. When a Linux or Windows boot disk runs out of space, the OS can become unresponsive because critical processes (e.g., systemd, journald, or the Windows Registry) cannot write to disk. In Google Cloud, the boot disk is the root device (typically /dev/sda1), and filling it to 95% on a 100 GB disk means only 5 GB remains, which is easily exhausted by normal system activity.

Answer

The data disk is pd-standard, which is causing I/O bottlenecks for the OS.

Answer

The boot disk is pd-ssd, which is too slow for the workload.

Answer

The instance has run out of IOPS on the boot disk.

Question 13

You are reviewing an IAM policy for a Cloud Storage bucket. Alice is a member of the data-team group. What level of access does Alice have to objects in this bucket?

Accepted Answer

Read and write access (admin).. The IAM policy grants the data-team group the roles/storage.objectAdmin role, which provides full read, write, and delete access to objects in the bucket. Alice, as a member of the data-team group, inherits this role and therefore has read and write (admin) access to the objects.

Answer

Read-only access.

Answer

No access, because the group policy overrides the individual policy.

Answer

Write-only access.

Question 14

Your company runs a critical application on Google Kubernetes Engine (GKE) in us-central1. The application consists of a frontend deployment with 3 replicas and a backend statefulset with 5 replicas using persistent volumes (SSD). Recently, the team noticed that during a regional outage in us-central1, the application became completely unavailable. They want to design a multi-region architecture that can survive a regional failure with RPO of 1 hour and RTO of 30 minutes. The application is stateless on the frontend but the backend stores critical data on persistent disks. The backend can operate in a read-only mode from a secondary region if needed. They have a limited budget and want to minimize ongoing costs. Which approach should they take?

Accepted Answer

Deploy the frontend and backend in a regional GKE cluster across us-central1, and use a CronJob to take snapshots of persistent volumes every hour and copy them to a secondary region. In disaster, restore the snapshots to a new cluster in the secondary region.. Meets the RPO of 1 hour by using a CronJob to take hourly snapshots of PersistentVolume data and copy them to a secondary region. In a disaster, you restore those snapshots to a new GKE cluster in the secondary region, achieving an RTO of 30 minutes by automating the restore process. This approach minimizes ongoing costs because snapshots are incremental and you only pay for storage in the secondary region when needed, while the frontend remains stateless and can be redeployed quickly.

Answer

Migrate the backend to Cloud SQL for MySQL with cross-region replication, and keep the frontend on GKE with multi-region ingress.

Answer

Deploy the frontend and backend in a regional GKE cluster and use regional persistent disks for the statefulset, replicating data synchronously across zones.

Answer

Deploy the frontend and backend in a single zonal cluster in us-central1-a, and use scheduled snapshots of persistent disks to a different region.

Question 15

A company is migrating a monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single Compute Engine instance and stores session state in local memory. The migration must support horizontal scaling and high availability. What should the company do to manage session state in the new architecture?

Accepted Answer

Refactor the application to store session state in Cloud Memorystore for Redis and make the application stateless.. Migrating to a stateless architecture with Cloud Memorystore for Redis allows the application to scale horizontally without session state being tied to any single pod. By externalizing session state to a managed, highly available Redis service, any pod can handle any request, which is essential for high availability and autoscaling in GKE.

Answer

Use a StatefulSet with a headless service to assign stable network identities to pods.

Answer

Use GKE Ingress with session affinity (sticky sessions) to route requests to the same pod.

Answer

Store session state in Cloud SQL using a replicated database.

Question 16

A company runs a batch processing workload on Compute Engine instances in a managed instance group (MIG). The job is CPU-intensive and takes approximately 4 hours to complete. The company wants to reduce costs without sacrificing performance. Which action should they take?

Accepted Answer

Use preemptible VMs for the MIG and implement a checkpointing mechanism to handle interruptions.. Preemptible VMs are significantly cheaper than standard VMs but can be terminated at any time. For a batch processing workload that is CPU-intensive and runs for 4 hours, using preemptible VMs in a MIG with a checkpointing mechanism allows the job to resume from the last saved state after an interruption, thus reducing costs without sacrificing performance.

Answer

Purchase committed use discounts for the instance type.

Answer

Change the machine series to a smaller machine type.

Answer

Provision additional reserved VMs to ensure capacity.

Question 17

An organization has deployed a multi-region Cloud Spanner instance for a global application. The application is experiencing high latency for read requests from a specific region. The team has verified that the application is using stale reads and the data distribution is even. What is the most likely cause of the high latency?

Accepted Answer

The Spanner instance does not have a read replica in a location close to the clients.. Cloud Spanner uses a single global configuration with regional read replicas. If the instance does not have a read replica in the region where the clients are located, read requests must traverse the network to a replica in another region, causing higher latency. Even with stale reads, the physical distance to the nearest replica directly impacts read latency.

Answer

The number of read replicas in the region is insufficient to handle the read volume.

Answer

The Spanner instance has too few nodes, causing contention.

Answer

The application is using read-write transactions instead of read-only transactions.

Question 18

A company is using Cloud Load Balancing to distribute traffic to a managed instance group (MIG) of web servers. The web servers are currently running in us-central1. To improve availability, the company plans to add a second MIG in us-west1. What must be done to ensure traffic is automatically routed to the closest healthy backend?

Accepted Answer

Use a global external HTTP(S) load balancer and add both MIGs as backends.. A global external HTTP(S) load balancer can route traffic to backends in multiple regions and automatically directs requests to the closest healthy backend based on the client's geographic location and backend health. Adding both MIGs as backends to this single anycast IP ensures traffic is distributed to the nearest region without additional DNS-based routing or redirects.

Answer

Use a Network Load Balancer in us-central1 and configure a redirect to the new MIG.

Answer

Use an internal TCP/UDP load balancer in each region and configure DNS-based routing.

Answer

Use an external TCP/UDP Network Load Balancer with the new MIG as an additional backend.

Question 19

A company is designing a disaster recovery plan for a critical application running on Compute Engine. The application uses a PostgreSQL database and stores files on persistent disks. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. Which two actions should the company take?

Accepted Answer

Configure PostgreSQL replication to a standby instance in another region.. PostgreSQL replication to a standby instance in another region meets both the RPO of 1 hour (near-real-time replication keeps data loss minimal) and the RTO of 4 hours (a standby can be promoted quickly). This is a standard disaster recovery pattern for cross-region resilience, ensuring that database changes are continuously replicated with minimal lag.

Answer

Create an instance template for the application and store it in Cloud Storage.

Answer

Take hourly persistent disk snapshots and store them in the same region.

Answer

Use Cloud Storage to store database backups and transfer them to a different region daily.

Question 20

Your company runs a containerized microservices application on Google Kubernetes Engine (GKE) with a regional cluster. The application consists of a frontend service, a backend API service, and a background worker service that processes messages from Cloud Pub/Sub. The worker service uses a Deployment with 3 replicas. Recently, the team noticed that the worker service is frequently failing with 'ContainerCreating' errors. The error message in the pod events is: 'Failed to pull image "gcr.io/my-project/my-worker:latest": rpc error: code = DeadlineExceeded desc = context deadline exceeded'. The image is stored in Container Registry in the same project. The cluster nodes are n1-standard-2 VMs with 10 GB of disk space. The team has confirmed that the image exists and that the nodes have internet access. What is the most likely cause of the issue?

Accepted Answer

The nodes have insufficient disk space to pull the new image, causing the pull to time out.. The error 'context deadline exceeded' when pulling an image indicates that the kubelet timed out while trying to download the container image. With only 10 GB of disk space on n1-standard-2 nodes, the node's disk may be nearly full, causing the image pull to stall or fail due to insufficient space to unpack the layers. This is the most likely cause because the image exists and internet access is confirmed, ruling out authentication or connectivity issues.

Answer

The worker pods require node affinity to a specific node pool that is not configured.

Answer

The nodes do not have the necessary permissions to access Container Registry.

Answer

The cluster is a regional cluster, but the worker pods are all scheduled in the same zone, causing resource contention.