Google PCA Manage implementation of cloud architecture Practice Test 2 — 15 Questions

Question 1

A company is using Cloud Load Balancing to distribute traffic to a managed instance group (MIG) of web servers. The web servers are currently running in us-central1. To improve availability, the company plans to add a second MIG in us-west1. What must be done to ensure traffic is automatically routed to the closest healthy backend?

Accepted Answer

Use a global external HTTP(S) load balancer and add both MIGs as backends.. A global external HTTP(S) load balancer can route traffic to backends in multiple regions and automatically directs requests to the closest healthy backend based on the client's geographic location and backend health. Adding both MIGs as backends to this single anycast IP ensures traffic is distributed to the nearest region without additional DNS-based routing or redirects.

Answer

Use a Network Load Balancer in us-central1 and configure a redirect to the new MIG.

Answer

Use an internal TCP/UDP load balancer in each region and configure DNS-based routing.

Answer

Use an external TCP/UDP Network Load Balancer with the new MIG as an additional backend.

Question 2

A company is designing a disaster recovery plan for a critical application running on Compute Engine. The application uses a PostgreSQL database and stores files on persistent disks. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. Which two actions should the company take?

Accepted Answer

Configure PostgreSQL replication to a standby instance in another region.. Option C is correct because PostgreSQL replication to a standby instance in another region meets both the RPO of 1 hour (near-real-time replication keeps data loss minimal) and the RTO of 4 hours (a standby can be promoted quickly). This is a standard disaster recovery pattern for cross-region resilience, ensuring that database changes are continuously replicated with minimal lag.

Answer

Create an instance template for the application and store it in Cloud Storage.

Answer

Take hourly persistent disk snapshots and store them in the same region.

Answer

Use Cloud Storage to store database backups and transfer them to a different region daily.

Question 3

Your company runs a containerized microservices application on Google Kubernetes Engine (GKE) with a regional cluster. The application consists of a frontend service, a backend API service, and a background worker service that processes messages from Cloud Pub/Sub. The worker service uses a Deployment with 3 replicas. Recently, the team noticed that the worker service is frequently failing with 'ContainerCreating' errors. The error message in the pod events is: 'Failed to pull image "gcr.io/my-project/my-worker:latest": rpc error: code = DeadlineExceeded desc = context deadline exceeded'. The image is stored in Container Registry in the same project. The cluster nodes are n1-standard-2 VMs with 10 GB of disk space. The team has confirmed that the image exists and that the nodes have internet access. What is the most likely cause of the issue?

Accepted Answer

The nodes have insufficient disk space to pull the new image, causing the pull to time out.. The error 'context deadline exceeded' when pulling an image indicates that the kubelet timed out while trying to download the container image. With only 10 GB of disk space on n1-standard-2 nodes, the node's disk may be nearly full, causing the image pull to stall or fail due to insufficient space to unpack the layers. This is the most likely cause because the image exists and internet access is confirmed, ruling out authentication or connectivity issues.

Answer

The worker pods require node affinity to a specific node pool that is not configured.

Answer

The nodes do not have the necessary permissions to access Container Registry.

Answer

The cluster is a regional cluster, but the worker pods are all scheduled in the same zone, causing resource contention.

Question 4

Your organization is moving a legacy monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single virtual machine with a local MySQL database. You need to design a cloud-native architecture that improves scalability and reliability. Which two actions should you take? (Choose TWO.)

Accepted Answer

Refactor the application into microservices and deploy each as a separate deployment in GKE.. Option B is correct because refactoring the monolithic application into microservices and deploying each as a separate Deployment in GKE aligns with cloud-native principles, enabling independent scaling, fault isolation, and easier updates. This approach improves scalability and reliability by allowing each microservice to scale horizontally based on demand, and failures in one service do not cascade to others.

Answer

Deploy the entire application in a single container with a large custom machine type to handle load.

Answer

Expose the application using a simple Service of type LoadBalancer with round-robin distribution.

Answer

Use a single Pod with multiple containers that communicate via localhost to reduce latency.

Question 5

Your company runs a critical application on Compute Engine instances in a managed instance group across three zones. The application writes logs to local disk. You are asked to improve the reliability of log retention and ensure logs are available in case of instance failure. You have already configured a health check that automatically recreates instances. However, after a recent zonal outage, logs from the affected instances were lost. You need to implement a solution that preserves logs even when instances are terminated. What should you do?

Accepted Answer

Install the Cloud Logging agent on each instance and configure it to stream application logs to Cloud Logging.. Option C is correct because the Cloud Logging agent streams logs directly to Cloud Logging (now part of Google Cloud's operations suite), which stores logs independently of the Compute Engine instances. This ensures logs are preserved even if instances are terminated due to a zonal outage or health check recreation, as logs are sent to a centralized, durable logging service rather than being stored on local disk.

Answer

Increase the size of the local SSD to accommodate more logs and set a longer retention period.

Answer

Configure each instance to write logs to a persistent disk that is retained after instance deletion.

Answer

Mount a Cloud Storage bucket using gcsfuse on each instance and write logs directly to the bucket.

Question 6

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the cluster can automatically scale based on custom metrics, such as the number of pending requests per pod. Which two steps should they take? (Choose TWO)

Accepted Answer

Deploy the Metrics Server in the cluster to expose custom metrics via the Custom Metrics API.. Option A is correct because the Metrics Server is required to expose custom metrics via the Custom Metrics API in GKE. Without it, the HorizontalPodAutoscaler (HPA) cannot retrieve the custom metrics needed for scaling decisions. Option B is correct because the application must expose custom metrics (e.g., pending requests) through an endpoint, and the HPA must be configured to reference that custom metric name to trigger scaling based on that specific value.

Answer

Enable the Cloud Monitoring API and create a custom dashboard to track pending requests.

Answer

Configure a HorizontalPodAutoscaler (HPA) with the target average CPU utilization set to 80%.

Answer

Enable GKE Autopilot mode to automatically manage scaling based on custom metrics.

Question 7

A developer runs the command above and sees the output. The cluster has one node pool with 3 nodes, each of type e2-standard-4 (4 vCPU, 16 GB RAM). The application requires at least 2 GB of memory per pod and the cluster has 10 pods that need to be scheduled. The developer also notices that the node pool autoscaling is enabled with a minimum of 1 and maximum of 5 nodes. However, the cluster is unable to schedule all pods. What is the most likely cause?

Accepted Answer

The pod resource requests exceed the allocatable resources on the existing nodes after accounting for system reservations.. Option D is correct because the cluster has 3 e2-standard-4 nodes, each with 4 vCPU and 16 GB RAM. After accounting for system reservations (e.g., kubelet, OS, daemonsets), the allocatable memory per node is typically around 13-14 GB. With 10 pods each requesting 2 GB, the total memory request is 20 GB, but the total allocatable memory across 3 nodes is only about 39-42 GB. However, the autoscaler can only scale up to 5 nodes, and even then, the total allocatable memory would be around 65-70 GB, which is sufficient. The most likely cause is that the pod resource requests exceed the allocatable resources on the existing nodes, preventing scheduling, and the autoscaler may not have triggered yet or is constrained by other factors like CPU or node limits.

Answer

The cluster is running an older version of Kubernetes that does not support node auto-scaling.

Answer

The node pool autoscaler is not properly configured to scale up based on pod resource requests.

Answer

The node auto-repair feature is disabled, causing a node to be unhealthy.

Question 8

A large e-commerce company runs a multi-tier application on Google Cloud. The frontend is served by a global HTTP Load Balancer with a backend service pointing to a managed instance group (MIG) of nginx web servers. The application tier consists of a regional internal TCP/UDP load balancer distributing traffic to a MIG of Java application servers. The database tier uses Cloud SQL for PostgreSQL in a failover replica configuration. The architecture is deployed in the us-central1 region across three zones. Recently, the operations team noticed intermittent 502 Bad Gateway errors from the frontend load balancer during peak traffic hours. The errors last for a few minutes and then recover. The team suspects the application tier is overwhelmed. They need to implement a solution that can handle traffic spikes without manual intervention. Which course of action should they take?

Accepted Answer

Configure HTTP health checks on the regional internal load balancer and set the autoscaler to use the 'HTTP load balancing utilization' metric for the application tier MIG.. Option C is correct because the intermittent 502 errors during peak traffic indicate that the application tier MIG is being overwhelmed. By configuring HTTP health checks on the regional internal load balancer and setting the autoscaler to use the 'HTTP load balancing utilization' metric, the autoscaler can scale the application tier MIG based on the actual load distribution from the internal load balancer, ensuring it handles traffic spikes without manual intervention. This directly addresses the root cause—insufficient application instances—by enabling dynamic scaling based on real-time utilization.

Answer

Increase the maximum number of instances in the application tier MIG from 10 to 20.

Answer

Enable Cloud Armor on the frontend load balancer with a rate-limiting rule to block excessive traffic.

Answer

Enable Cloud CDN on the frontend load balancer to cache static assets and reduce load on the application tier.

Question 9

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) using a Deployment into the correct order.

Question 10

Match each IAM role type to its description.

Question 11

A company is migrating a monolithic application to Google Cloud. They want to minimize changes to the application code while taking advantage of Cloud Run for serverless containers. Which approach should they take?

Accepted Answer

Use Cloud Run by packaging the existing application as a container and listening on a web server.. Option D is correct because Cloud Run can run any containerized application that listens on HTTP requests on port 8080. By packaging the existing monolithic application as a container and adding a lightweight web server (e.g., Express, Flask, or Nginx), the company can deploy it to Cloud Run with minimal code changes, leveraging serverless scaling and pay-per-use pricing without refactoring into microservices.

Answer

Deploy the application to App Engine standard environment with automatic scaling.

Answer

Lift and shift the application to Compute Engine instances behind a load balancer.

Answer

Refactor the application into microservices and deploy each as a separate Cloud Run service.

Question 12

An organization has a multi-regional deployment of a stateful application on GKE using regional persistent disks. They need to implement disaster recovery with an RPO of less than 1 hour and RTO of 30 minutes. What is the most cost-effective approach?

Accepted Answer

Use regional persistent disks with asynchronous replication to a secondary region and deploy GKE clusters in both regions with a load balancer directing traffic.. Option B is correct because regional persistent disks with asynchronous replication provide built-in, managed replication to a secondary region, meeting the RPO of less than 1 hour and RTO of 30 minutes without additional infrastructure costs. By deploying GKE clusters in both regions and using a load balancer, traffic can be redirected to the secondary cluster within the RTO, making this the most cost-effective approach as it avoids third-party tools or complex manual processes.

Answer

Use zonal persistent disks and take snapshots every 45 minutes, then restore in secondary region.

Answer

Use a third-party replication tool to asynchronously replicate data to the secondary region.

Answer

Use Cloud Storage FUSE to write state to a multi-regional bucket and read from secondary cluster.

Question 13

A DevOps team is building a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine. They want to ensure that each microservice can be deployed independently without affecting other services. Which strategy should they use?

Accepted Answer

Implement canary deployments with a service mesh such as Istio and use separate Cloud Build triggers per microservice.. Option A is correct because it combines canary deployments with a service mesh (Istio) to gradually shift traffic to a new version of a single microservice, ensuring independent deployment without impacting other services. Separate Cloud Build triggers per microservice allow each service to be built and deployed independently, aligning with the microservices architecture's requirement for decoupled release cycles.

Answer

Use blue/green deployments with a global load balancer to switch traffic.

Answer

Use Cloud Deploy with rollout strategies and keep all microservices in the same GKE namespace.

Answer

Create a single monolithic pipeline that deploys all microservices simultaneously.

Question 14

A company is using Cloud NAT to allow private instances to access the internet. They notice that outbound connections are failing intermittently. What is the most likely cause?

Accepted Answer

The number of concurrent connections exceeds the Cloud NAT source port capacity for the assigned NAT IPs.. Cloud NAT uses source network address translation (SNAT) to map private instance IPs to a single public IP address. Each NAT IP has a limited pool of source ports (typically 64,512 per IP for TCP/UDP). When concurrent connections exceed this capacity, new outbound connections are dropped, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures.

Answer

The private instances are using the wrong DNS server.

Answer

The VPC firewall rules are blocking egress traffic.

Answer

Cloud NAT does not support TCP connections.

Question 15

An organization needs to connect an on-premises data center to Google Cloud using Dedicated Interconnect with a 10 Gbps link. They require high availability and want to achieve 99.99% SLA. What is the minimum number of VLAN attachments and Interconnect connections needed?

Accepted Answer

Two Interconnect connections, each with one VLAN attachment.. To achieve 99.99% SLA with Dedicated Interconnect, you need two separate Interconnect connections (for physical diversity) and each connection must have at least one VLAN attachment. The SLA requires redundant paths; a single Interconnect connection, even with multiple VLAN attachments, does not provide physical diversity and thus cannot meet the 99.99% uptime target.

Answer

One Interconnect connection with two VLAN attachments.

Answer

Four Interconnect connections with one VLAN attachment each.

Answer

Two Interconnect connections, each with two VLAN attachments.