Google PCA Manage implementation of cloud architecture Practice Test 3 — 15 Questions

Question 1

A company is using Cloud NAT to allow private instances to access the internet. They notice that outbound connections are failing intermittently. What is the most likely cause?

Accepted Answer

The number of concurrent connections exceeds the Cloud NAT source port capacity for the assigned NAT IPs.. Cloud NAT uses source network address translation (SNAT) to map private instance IPs to a single public IP address. Each NAT IP has a limited pool of source ports (typically 64,512 per IP for TCP/UDP). When concurrent connections exceed this capacity, new outbound connections are dropped, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures.

Answer

The private instances are using the wrong DNS server.

Answer

The VPC firewall rules are blocking egress traffic.

Answer

Cloud NAT does not support TCP connections.

Question 2

An organization needs to connect an on-premises data center to Google Cloud using Dedicated Interconnect with a 10 Gbps link. They require high availability and want to achieve 99.99% SLA. What is the minimum number of VLAN attachments and Interconnect connections needed?

Accepted Answer

Two Interconnect connections, each with one VLAN attachment.. To achieve 99.99% SLA with Dedicated Interconnect, you need two separate Interconnect connections (for physical diversity) and each connection must have at least one VLAN attachment. The SLA requires redundant paths; a single Interconnect connection, even with multiple VLAN attachments, does not provide physical diversity and thus cannot meet the 99.99% uptime target.

Answer

One Interconnect connection with two VLAN attachments.

Answer

Four Interconnect connections with one VLAN attachment each.

Answer

Two Interconnect connections, each with two VLAN attachments.

Question 3

A company is using Cloud SQL for PostgreSQL and needs to run a one-time heavy analytical query that takes over 30 minutes and uses 100% CPU. The production database is serving user traffic with high QPS. What should the company do to run the query without impacting production?

Accepted Answer

Create a read replica of the production instance and run the query on the replica.. A read replica in Cloud SQL for PostgreSQL is a separate instance that asynchronously replicates data from the primary. Running the heavy analytical query on the replica offloads the CPU-intensive workload from the production primary, ensuring user-facing traffic with high QPS is not impacted. The replica can handle read-only queries without affecting the primary's performance or availability.

Answer

Run the query directly on the primary instance during low traffic hours.

Answer

Use Cloud SQL's pgBouncer to pool connections and queue the query.

Answer

Create a clone of the production instance and run the query on the clone.

Question 4

A developer accidentally deleted a bucket in Cloud Storage. The bucket had object versioning enabled. How can the bucket and its objects be restored?

Accepted Answer

Contact Cloud Support to restore the bucket from the undisclosed backup within a limited time window.. When a Cloud Storage bucket is deleted, even with versioning enabled, the bucket itself is removed along with its objects. Google Cloud does not provide a self-service restore option for deleted buckets; instead, it maintains an internal, undisclosed backup for a limited time (typically 7 days). Only Cloud Support can initiate the restoration process from this backup, making Option A the correct approach.

Answer

Restore the bucket from the Trash in the Cloud Console.

Answer

Enable bucket lock and then undo deletion.

Answer

Use the gsutil ls -a command to list deleted buckets and gsutil cp to restore.

Question 5

A company is using Cloud Armor with HTTP Load Balancing to protect a web application. They want to block traffic from specific IP ranges for all requests except those that include a valid reCAPTCHA token. Which Cloud Armor rule configuration should they use?

Accepted Answer

Create a deny rule for the IP ranges with a condition that the request does not contain a valid reCAPTCHA token.. Cloud Armor security rules support boolean conditions using operators like `request.path` or custom headers. By creating a deny rule for the specific IP ranges with a condition that the request does not contain a valid reCAPTCHA token (evaluated via the `hasRecaptchaToken()` function), you allow traffic from those IPs only when the token is present. This directly implements the requirement without affecting other traffic.

Answer

Use a rate-based rule to limit requests from those IP ranges and add a reCAPTCHA action.

Answer

Create a whitelist rule for the IP ranges and attach it as a deny rule with higher priority.

Answer

Use Identity-Aware Proxy (IAP) to block the IPs and reCAPTCHA for others.

Question 6

A company is deploying a new application on Compute Engine and wants to automate the installation of a custom agent on every newly created VM in a specific project. Which Google Cloud service should they use?

Accepted Answer

VM Manager (OS Config) with a guest policy to install the agent.. VM Manager (OS Config) with a guest policy is the correct choice because it provides a native, agent-based configuration management service that can enforce the installation of a custom agent on all existing and newly created VMs in a project without requiring changes to instance templates or startup scripts. Guest policies are evaluated and applied at VM boot time and periodically thereafter, ensuring consistent agent deployment across the fleet.

Answer

Instance templates with startup scripts.

Answer

Deployment Manager with a template that includes the agent installation.

Answer

Cloud Build triggered on new VM creation events.

Question 7

Which TWO statements about Google Cloud VPC firewall rules are correct? (Choose two.)

Accepted Answer

Firewall rules allow you to specify both source and destination IP ranges.. Google Cloud VPC firewall rules are stateful and allow you to specify both source and destination IP ranges in a single rule. This enables granular control over traffic direction, such as allowing ingress from a specific source CIDR to a specific destination CIDR within the VPC.

Answer

Firewall rules are stateless and require explicit rules for return traffic.

Answer

Default VPC has firewall rules that block all ingress traffic.

Answer

Firewall rules cannot be applied to instances by service account.

Question 8

Which THREE factors should be considered when choosing a Google Cloud region for deploying a low-latency application serving global users? (Choose three.)

Accepted Answer

Proximity to your user base to minimize network latency.. Deploying in a Google Cloud region geographically close to your user base minimizes network latency, which is critical for low-latency applications. Google Cloud's global network uses edge points of presence (PoPs) and premium tier routing to reduce round-trip time (RTT), but the physical distance between the region and users still directly impacts latency due to the speed of light and fiber optic propagation delays.

Answer

Pricing differences between regions due to variations in compute and storage costs.

Answer

Number of zones in the region to ensure high availability.

Question 9

Which TWO methods can be used to provide secure access to a private Google Kubernetes Engine (GKE) cluster from the internet? (Choose two.)

Accepted Answer

Use Cloud VPN to connect from an on-premises network that has internet access.. Cloud VPN establishes an encrypted tunnel (using IPsec) from an on-premises network to a VPC in Google Cloud, allowing secure access to a private GKE cluster master endpoint without exposing it to the public internet. Option E is correct because Identity-Aware Proxy (IAP) with TCP forwarding enables authenticated and authorized access to the private cluster master endpoint via a bastion-like tunnel, without requiring a public IP on the master or a VPN.

Answer

Expose the cluster via an internal load balancer.

Answer

Configure a Cloud NAT to allow inbound connections from the internet.

Answer

Assign a public IP address to the cluster master endpoint.

Question 10

What is the most likely reason the NetworkPolicy is not taking effect?

Accepted Answer

The developer used the networking.k8s.io/v1 API version instead of the Calico CRD projectcalico.org/v3.. The NetworkPolicy is not taking effect because the developer used the standard Kubernetes API version `networking.k8s.io/v1`, which defines a different schema and behavior than the Calico CRD `projectcalico.org/v3`. Calico NetworkPolicies support advanced features like order-of-precedence, global policies, and non-IP match criteria that are not available in the native Kubernetes NetworkPolicy API. When a Calico-specific policy is defined using the wrong API version, the cluster's policy engine (Calico) ignores it, resulting in no enforcement.

Answer

The cluster has a global network policy that overrides per-namespace policies.

Answer

The pod labels do not match because of a capitalization mismatch.

Answer

The NetworkPolicy is missing a spec.podSelector.matchLabels entry.

Question 11

Why did the VM resource fail while the disk succeeded?

Accepted Answer

The VM definition is missing a boot disk source reference.. When you define a VM instance in Google Cloud, you must include a reference to a boot disk source. If the `source` field under `disks` is missing or empty, the API will reject the VM creation but may still succeed in creating the disk resource separately, since the disk creation does not depend on the VM. This explains why the disk succeeded while the VM failed.

Answer

The disk and VM must be in the same zone; us-central1-a is consistent.

Answer

The VM's machine type is not available in us-central1-a.

Answer

The VM's network is misspelled as 'global/networks/default' instead of 'global/networks/default' (correct).

Question 12

A developer is trying to deploy a Compute Engine instance from a Cloud Build step. The build fails with the above error. What is the problem?

Accepted Answer

Cloud Build does not have the 'iam.serviceAccounts.actAs' permission on the default compute service account.. The error occurs because Cloud Build needs to impersonate the Compute Engine default service account to create a VM instance. The Cloud Build service account requires the 'iam.serviceAccounts.actAs' permission on the target service account to delegate its identity. Without this permission, the build step fails even if the Cloud Build service account has 'compute.instances.create' permission.

Answer

The project has exceeded its service account quota.

Answer

The Cloud Build service account lacks 'compute.instances.create' permission.

Answer

The developer's personal account does not have permission to use Cloud Build.

Question 13

A startup wants to deploy a containerized application with minimal operational overhead. They expect variable traffic. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it is a fully managed serverless compute platform that automatically scales from zero based on traffic, charges only for resources used during request processing, and eliminates all infrastructure management. This aligns perfectly with the startup's requirement for minimal operational overhead and handling variable traffic patterns without provisioning or scaling concerns.

Answer

App Engine Flexible Environment

Answer

Compute Engine single VM

Answer

Google Kubernetes Engine (GKE)

Question 14

A company has a requirement to store application logs for 7 years for compliance. They are using Cloud Logging. What is the most cost-effective way to retain logs?

Accepted Answer

Export logs to Cloud Storage with Object Lifecycle management to delete after 7 years. Cloud Logging's default retention is limited (e.g., 30 days for logs in the default _Default bucket, and up to 365 days for custom log buckets). To meet a 7-year compliance requirement cost-effectively, you should export logs to Cloud Storage and use Object Lifecycle Management to delete objects after 7 years. Cloud Storage offers lower long-term storage costs than retaining logs in Logging's _Required or custom buckets, and lifecycle rules automate deletion without ongoing compute costs.

Answer

Set the log bucket retention to 7 years

Answer

Export logs to BigQuery and run scheduled queries to delete old data

Answer

Use Cloud Logging's default retention and rely on backups

Question 15

An organization is using Shared VPC with multiple projects. They want to allow a service project to use a Cloud SQL instance created in the host project. Which step is required?

Accepted Answer

Create the Cloud SQL instance with a private IP and enable Private Services Access in the host project. When using Shared VPC, a service project can use a Cloud SQL instance with a private IP from the host project's VPC. To enable this, the Cloud SQL instance must be created with a private IP and Private Services Access must be configured in the host project. This establishes a VPC peering connection between the host project's VPC and the Google-managed Cloud SQL service network, allowing the service project's resources to communicate with the instance via internal IP.

Answer

Grant the service project's Cloud SQL service account the Cloud SQL Client role on the host project

Answer

Configure VPC peering between host and service project

Answer

Enable the Cloud SQL Admin API in the service project