Google PCA Manage implementation of cloud architecture Practice Test 2 — 15 Questions

Question 1

Which TWO statements about Google Cloud VPC firewall rules are correct? (Choose two.)

Accepted Answer

Firewall rules allow you to specify both source and destination IP ranges.. Option B is correct because Google Cloud VPC firewall rules let you define both a source (via sourceRanges or sourceTags/sourceServiceAccounts) and a destination (via destinationRanges or targetTags/targetServiceAccounts), enabling granular control over traffic between specific IP ranges. Option E is correct because hierarchical firewall policies are a distinct resource that can be attached at the organization, folder, or project node in the resource hierarchy, and they are evaluated before VPC firewall rules. Option A is wrong because VPC firewall rules are stateful — return traffic for allowed connections is automatically permitted, so no explicit return rule is needed. Option C is wrong because the default VPC comes with implied rules that allow all ingress from within the VPC and allow egress to all destinations, plus predefined rules like default-allow-internal, default-allow-ssh, and default-allow-icmp; it does not block all ingress. Option D is wrong because firewall rules can target or source instances by service account using targetServiceAccounts and sourceServiceAccounts.

Answer

Firewall rules are stateless and require explicit rules for return traffic.

Answer

Default VPC has firewall rules that block all ingress traffic.

Answer

Firewall rules cannot be applied to instances by service account.

Question 2

Which TWO methods can be used to provide secure access to a private Google Kubernetes Engine (GKE) cluster from the internet? (Choose two.)

Accepted Answer

Use Cloud VPN to connect from an on-premises network that has internet access.. Option C is correct because a private GKE cluster's control plane only has an internal endpoint, so a Cloud VPN tunnel (or Cloud Interconnect) from an on-premises network that itself has internet access provides a secure, encrypted path to reach the master without exposing it publicly. Option E is correct because IAP with TCP forwarding lets authorized users tunnel to the private master endpoint over HTTPS through Google's infrastructure, enforcing IAM-based access control without assigning a public IP. Option A is wrong because an internal load balancer only exposes workloads to internal VPC clients, not to the internet. Option B is wrong because Cloud NAT provides outbound-only translation for private instances and does not accept inbound connections from the internet. Option D is wrong because assigning a public IP to the master endpoint removes the private-cluster isolation and exposes the control plane directly to the internet, which is not a secure access method.

Answer

Expose the cluster via an internal load balancer.

Answer

Configure a Cloud NAT to allow inbound connections from the internet.

Answer

Assign a public IP address to the cluster master endpoint.

Question 3

What is the most likely reason the NetworkPolicy is not taking effect?

Accepted Answer

The developer used the networking.k8s.io/v1 API version instead of the Calico CRD projectcalico.org/v3.. The NetworkPolicy is not taking effect because the developer used the standard Kubernetes API version `networking.k8s.io/v1`, which defines a different schema and behavior than the Calico CRD `projectcalico.org/v3`. Calico NetworkPolicies support advanced features like order-of-precedence, global policies, and non-IP match criteria that are not available in the native Kubernetes NetworkPolicy API. When a Calico-specific policy is defined using the wrong API version, the cluster's policy engine (Calico) ignores it, resulting in no enforcement.

Answer

The cluster has a global network policy that overrides per-namespace policies.

Answer

The pod labels do not match because of a capitalization mismatch.

Answer

The NetworkPolicy is missing a spec.podSelector.matchLabels entry.

Question 4

Why did the VM resource fail while the disk succeeded?

Accepted Answer

The VM definition is missing a boot disk source reference.. When you define a VM instance in Google Cloud, you must include a reference to a boot disk source. If the `source` field under `disks` is missing or empty, the API will reject the VM creation but may still succeed in creating the disk resource separately, since the disk creation does not depend on the VM. This explains why the disk succeeded while the VM failed.

Answer

The disk and VM must be in the same zone; us-central1-a is consistent.

Answer

The VM's machine type is not available in us-central1-a.

Answer

The VM's network is misspelled as 'global/networks/default' instead of 'global/networks/default' (correct).

Question 5

A company has a requirement to store application logs for 7 years for compliance. They are using Cloud Logging. What is the most cost-effective way to retain logs?

Accepted Answer

Export logs to Cloud Storage with Object Lifecycle management to delete after 7 years. Cloud Logging's default retention is limited (e.g., 30 days for logs in the default _Default bucket, and up to 365 days for custom log buckets). To meet a 7-year compliance requirement cost-effectively, you should export logs to Cloud Storage and use Object Lifecycle Management to delete objects after 7 years. Cloud Storage offers lower long-term storage costs than retaining logs in Logging's _Required or custom buckets, and lifecycle rules automate deletion without ongoing compute costs.

Answer

Set the log bucket retention to 7 years

Answer

Export logs to BigQuery and run scheduled queries to delete old data

Answer

Use Cloud Logging's default retention and rely on backups

Question 6

An organization is using Shared VPC with multiple projects. They want to allow a service project to use a Cloud SQL instance created in the host project. Which step is required?

Accepted Answer

Create the Cloud SQL instance with a private IP and enable Private Services Access in the host project. When using Shared VPC, a service project can use a Cloud SQL instance with a private IP from the host project's VPC. To enable this, the Cloud SQL instance must be created with a private IP and Private Services Access must be configured in the host project. This establishes a VPC peering connection between the host project's VPC and the Google-managed Cloud SQL service network, allowing the service project's resources to communicate with the instance via internal IP.

Answer

Grant the service project's Cloud SQL service account the Cloud SQL Client role on the host project

Answer

Configure VPC peering between host and service project

Answer

Enable the Cloud SQL Admin API in the service project

Question 7

An organization is implementing a Hub-and-Spoke network topology with multiple VPCs. Which Google Cloud product is designed for centralized connectivity and policy enforcement?

Accepted Answer

Shared VPC. Shared VPC (D) is the correct answer because it allows an organization to centrally manage connectivity and enforce network policies across multiple VPCs from a single host project. By designating a host project and attaching service projects, Shared VPC enables centralized control over firewall rules, routes, and IAM policies, which is essential for a hub-and-spoke topology where the host VPC acts as the hub and service VPCs as spokes.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Network Connectivity Center

Question 8

A financial services company runs a mission-critical database on Compute Engine with local SSDs. They need to ensure data durability in case of an instance failure while maintaining low latency. What should they do?

Accepted Answer

Configure a regional persistent disk with synchronous replication and attach it to the instance. Regional persistent disks (PD) provide synchronous replication of data between two zones in the same region, ensuring data durability even if the entire zone fails. By attaching a regional PD to a Compute Engine instance, you maintain low latency (since the disk is network-attached but still within the same region) while achieving the required durability. Local SSDs, while offering very low latency, are ephemeral and lose data on instance failure, so they are not suitable for mission-critical durability requirements.

Answer

Use a managed instance group with autohealing and store data on a persistent disk

Answer

Set up a read replica in another zone using database-native replication

Answer

Take regular snapshots of the local SSDs to Cloud Storage

Question 9

A global e-commerce platform uses Spanner for its transactional database. They observe that some transactions are aborted with 'ABORTED' status due to contention. The application retries immediately, but throughput degrades. What design change should they implement to reduce contention?

Accepted Answer

Redesign the schema to use a separate table for frequently updated rows and batch updates using a single transaction. Spanner contention arises when multiple transactions try to update the same row concurrently, causing aborts. By redesigning the schema to use a separate table for frequently updated rows and batching updates into a single transaction, you reduce the number of overlapping locks on hot rows. This minimizes lock conflicts and aborts, improving throughput without changing Spanner's underlying TrueTime-based concurrency control.

Answer

Increase the number of nodes in the Spanner instance

Answer

Use client-side retry with exponential backoff and jitter

Answer

Change the transaction isolation level to READ UNCOMMITTED

Question 10

A healthcare SaaS provider runs workloads in Google Cloud and needs to comply with HIPAA. They use Cloud SQL for PostgreSQL and want to encrypt data at rest with customer-managed encryption keys (CMEK). Which steps must they take?

Accepted Answer

Create a Cloud KMS key ring and key, then specify the key when creating the Cloud SQL instance. Cloud SQL for PostgreSQL supports CMEK only at instance creation time. You must first create a Cloud KMS key ring and key in the same region as the instance, then specify that key when creating the Cloud SQL instance. This ensures that the data at rest is encrypted with a customer-managed key, meeting HIPAA compliance requirements for control over encryption keys.

Answer

Use customer-supplied encryption keys (CSEK) by uploading your own key material

Answer

Enable CMEK in the Cloud SQL instance's settings after creation

Answer

Create a Cloud HSM key and grant the Cloud SQL service account access to it

Question 11

A media streaming company uses Google Cloud CDN to deliver content. They notice that users in certain regions experience high latency despite CDN caching. The content is dynamic based on user location (e.g., local news). What should they do to improve performance?

Accepted Answer

Deploy Cloud Run services in multiple regions and use a global external HTTPS load balancer with backend services to route requests to the nearest region. Deploying Cloud Run services in multiple regions and using a global external HTTPS load balancer with backend services enables location-based routing via the load balancer's anycast IP and backend service configuration. The load balancer automatically routes user requests to the nearest Cloud Run backend that has capacity, reducing latency for dynamic, location-specific content that cannot be effectively cached by Cloud CDN.

Answer

Use Cloud Functions with a regional HTTP trigger and Cloud CDN to cache the responses

Answer

Use Cloud Armor to route traffic to the nearest point of presence

Answer

Configure Cloud CDN to use cache keys based on user location headers

Question 12

A company is migrating a legacy application to Google Cloud. The application has a stateful TCP-based protocol that requires client IP persistence. They plan to use a load balancer. Which load balancer type should they choose?

Accepted Answer

External Network Load Balancer (passthrough). The External Network Load Balancer (passthrough) is the correct choice because it preserves the original client IP address via direct server return (DSR) and does not terminate the TCP connection. This is essential for stateful TCP-based protocols that require client IP persistence, as the backend instances see the actual client IP and can maintain session state.

Answer

External HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP Proxy Load Balancer

Question 13

Which TWO of the following are valid methods to securely access Google Cloud APIs from a Compute Engine instance without managing service account keys?

Accepted Answer

Attach a custom service account to the instance using the gcloud command. Option B is correct because attaching a custom service account to a Compute Engine instance (e.g., via `gcloud compute instances create --service-account=SA_EMAIL` or `gcloud compute instances set-service-account`) lets the instance obtain short-lived OAuth 2.0 access tokens from the metadata server at `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token`, eliminating the need to manage long-lived service account keys. Option E is correct because using the default Compute Engine service account also relies on the same metadata-server token flow, so applications on the instance can call Google Cloud APIs without any downloaded key file. Option A is incorrect because downloading and storing a service account key file is exactly the key-management practice the scenario seeks to avoid, and it introduces a long-lived credential that can be leaked. Option C is incorrect because granting IAM roles is an authorization step, not an access method; roles alone do not provide credentials or a token-acquisition mechanism. Option D is incorrect because Cloud KMS does not generate temporary credentials for calling Google Cloud APIs; it encrypts/decrypts data and manages keys, and it is not a substitute for the metadata-server token flow.

Answer

Download a service account key file and store it on the instance

Answer

Grant the appropriate IAM roles to the instance's service account

Answer

Use a Cloud KMS key to generate temporary credentials

Question 14

A company is migrating a monolithic application to Google Cloud and wants to minimize operational overhead for scaling. Which service should they use?

Accepted Answer

App Engine Standard. App Engine Standard is the correct choice because it provides a fully managed, autoscaling platform that abstracts away all infrastructure management, including server configuration, scaling, and load balancing. This minimizes operational overhead for scaling a monolithic application by automatically adjusting resources based on traffic without any manual intervention or cluster management.

Answer

Google Kubernetes Engine

Answer

Cloud Run

Answer

Compute Engine with managed instance groups

Question 15

A team is designing a multi-tier web application on Compute Engine. They need to ensure that only the web tier can access the application tier over a specific port. They plan to use VPC firewall rules. Which approach minimizes the attack surface?

Accepted Answer

Allow ingress from the web tier's instances' service accounts to the application tier's instances. It uses service account-based firewall rules, which allow you to specify the source as the service account attached to the web tier's instances rather than their IP addresses or subnets. This ensures that only instances with that specific service account (i.e., the web tier) can reach the application tier on the designated port, regardless of their IP or subnet. By scoping access to a specific identity, you minimize the attack surface because no other instances, even those in the same subnet, can reach the application tier unless they also use that service account.

Answer

Allow ingress from any source to the application tier on the port

Answer

Allow ingress from the web tier's subnet to the application tier's instances on the port

Answer

Allow egress from the web tier to the application tier