Google PCA Manage implementation of cloud architecture Practice Test 3 — 15 Questions

Question 1

A company is using Cloud SQL for MySQL and wants to implement automated backups that are retained for 30 days. They also need point-in-time recovery. Which configuration should they use?

Accepted Answer

Enable automated backups with binary logging. Cloud SQL for MySQL requires automated backups to be enabled along with binary logging to support point-in-time recovery (PITR). Binary logs record all changes to the database, allowing you to restore to any specific timestamp within the backup retention period. Setting the retention to 30 days ensures backups are kept for the required duration, and binary logging enables the granular recovery needed for PITR.

Answer

Enable database replication

Answer

Use Cloud Storage versioning

Answer

Enable automated backups and set backup retention to 30

Question 2

A company runs a critical application on Compute Engine with a stateful workload. They want to achieve 99.99% availability within a single region. Which architecture should they recommend?

Accepted Answer

Two instances in different zones with a regional persistent disk attached to the active instance and failover using a load balancer. It uses a regional persistent disk, which synchronously replicates data across two zones within the same region, ensuring data durability and availability. The active instance in one zone attaches the disk, and a load balancer with health checks detects failures and redirects traffic to the standby instance in the other zone, enabling automatic failover to meet the 99.99% availability target.

Answer

Two instances in different zones with a zonal persistent disk each and data replication using a custom script

Answer

One instance in a single zone with a persistent disk snapshot every hour

Answer

Four instances across two zones with a regional persistent disk and active-passive failover using a health check

Question 3

A company is using Cloud Armor to protect their external HTTPS load balancer. They want to block traffic from a specific list of IP ranges. They create a security policy with a deny rule. However, the denials seem not to be applied to all backend services. What is the most likely cause?

Accepted Answer

The security policy is attached to the load balancer's target proxy, but the deny rule priority is lower than an allow rule. Cloud Armor security policies are evaluated against the rules in priority order, with lower numbers having higher priority. If a deny rule has a higher priority number (lower priority) than an allow rule, the allow rule will be evaluated first and permit the traffic, effectively overriding the deny. The most likely cause is that the deny rule's priority is not set lower than any conflicting allow rules, so the allow rule matches first.

Answer

The security policy is not attached to the backend service

Answer

Cloud Armor policies only apply to global load balancers, not regional

Answer

The security policy has an allow rule that overrides the deny rule

Question 4

A company is designing a disaster recovery plan for their Cloud SQL for PostgreSQL instance. They want to ensure that the database can be recovered in another region within minutes with minimal data loss. Which three actions should they take? (Choose three.)

Accepted Answer

Enable point-in-time recovery. Option A (Enable point-in-time recovery) is correct because PITR lets you restore a Cloud SQL for PostgreSQL instance to any specific moment within the retention window, which directly supports the goal of minimal data loss (low RPO) after a regional disaster. Option B (Regularly test the failover procedure) is correct because a DR plan is only reliable if the recovery workflow is validated; rehearsing restores/failover ensures the team can actually recover in another region within minutes. Option D (Enable cross-region replication using Cloud SQL's replica feature) is correct because a cross-region read replica maintains a continuously updated copy of the data in a different region, allowing promotion to a primary in minutes with minimal data loss. Option C is not correct because a failover replica in another zone within the same region only provides zonal high availability, not protection against a full regional outage. Option E is not correct because automated backups with a 30-day retention help with longer-term recovery but do not by themselves provide a cross-region, minutes-level recovery capability.

Answer

Configure a failover replica in a different zone within the same region

Answer

Enable automated backups with a retention period of 30 days

Question 5

A company is running a multi-region application on Google Kubernetes Engine with workloads in us-central1 and europe-west1. They want to route traffic to the closest region based on user location. Which three components should they configure? (Choose three.)

Accepted Answer

Cloud DNS with geo-routing policy. Option B is correct because Cloud DNS geo-routing policies let DNS answers be selected based on the geographic location of the querying client, which is exactly what is needed to send users to the closest regional endpoint. Option C is correct because zonal or regional network endpoint groups (NEGs) can reference GKE pod IPs directly, enabling the load balancer to distribute traffic to the application backends in each region. Option E is correct because a global external HTTP(S) load balancer provides a single global anycast VIP and automatically routes client traffic to the closest healthy backend region, which is the core requirement for multi-region proximity routing. Option A is not correct because Cloud Armor is a WAF/DDoS protection service and does not perform geographic traffic routing. Option D is not correct because a regional internal load balancer only distributes traffic within a region and cannot provide global, location-based routing across us-central1 and europe-west1.

Answer

Cloud Armor security policy

Answer

Regional internal load balancer

Question 6

A company runs a real-time data analytics platform on Google Cloud that ingests streaming data from IoT devices. The architecture uses Cloud Pub/Sub to receive messages, Dataflow for processing, and BigQuery for storage. Recently, the team noticed that the processing latency has increased significantly during peak hours. Upon investigation, they found that the Dataflow pipeline is experiencing high system lag and some workers are being killed due to out-of-memory errors. The pipeline uses a fixed window of 10 seconds and writes to BigQuery using streaming inserts. The company wants to reduce latency without sacrificing data accuracy. Which course of action should they take?

Accepted Answer

Enable Dataflow streaming engine and use exactly-once processing mode. Enabling Dataflow streaming engine moves pipeline state and windowing out of the worker VMs and into the Dataflow service, reducing worker memory pressure and allowing more efficient scaling, which directly addresses the out-of-memory kills and high system lag. Using exactly-once processing mode ensures data accuracy is preserved while reducing latency. Together these address the root causes without sacrificing correctness.

Answer

Change the windowing to a global window and use batch inserts to BigQuery

Answer

Increase the number of Dataflow workers and machine type to handle the load

Answer

Implement a dead-letter queue for unprocessed messages and use a slower processing rate

Question 7

A multinational corporation has deployed a web application across multiple Google Cloud regions using an external HTTPS load balancer with backend services in each region. They recently added a new region (asia-southeast1) and updated the load balancer configuration. After the update, some users in that region report high latency and occasional connection timeouts when accessing the application. The load balancer health checks show all backends as healthy. The network team confirms that the backend instances in asia-southeast1 are correctly configured and can be accessed directly via their external IPs. What should the architects investigate next?

Accepted Answer

Review the Cloud Armor security policy rules that might be blocking traffic from that region. Cloud Armor security policies can block traffic based on geographic location. If the new region (asia-southeast1) was added but the Cloud Armor policy was not updated to allow traffic from that region, requests from users in asia-southeast1 could be denied or rate-limited, causing high latency and timeouts even though health checks (which originate from Google's health check ranges, not user IPs) show backends as healthy. The direct access via external IPs works because it bypasses the load balancer and its associated Cloud Armor policy.

Answer

Check the Cloud CDN cache settings for the new region

Answer

Verify that the backend service in asia-southeast1 has the correct timeout settings for the load balancer

Answer

Ensure that the firewall rules allow traffic from the load balancer's health check ranges to the instances

Question 8

A cloud architect is implementing a CI/CD pipeline for a microservices-based application on Google Kubernetes Engine (GKE). The team needs to deploy new versions of the services with zero downtime and the ability to quickly roll back if issues are detected. Which two strategies should the architect consider? (Choose two.)

Accepted Answer

Blue/green deployment. Blue/green deployment (C) is correct because it runs two identical environments where traffic is switched from the old (blue) version to the new (green) version only after the green environment is fully validated, enabling zero-downtime cutover and an instant rollback by simply routing traffic back to blue. Canary deployment (D) is correct because it gradually shifts a small percentage of traffic to the new version, allowing the team to monitor for issues and quickly roll back by routing traffic away from the canary if problems are detected, all without downtime. Rolling update (B) is not among the marked answers because although it is the default GKE Deployment strategy and avoids downtime, rollback is less immediate and it does not provide the same controlled traffic-switching guarantees emphasized in the scenario. Shadow deployment (A) mirrors production traffic to a new version without serving real users, so it cannot by itself deliver the new version to users with rollback capability, and A/B testing deployment (E) is aimed at comparing user behavior between variants rather than achieving zero-downtime release and fast rollback.

Answer

Shadow deployment

Answer

Rolling update

Answer

A/B testing deployment

Question 9

An organization has two Google Cloud projects: Project A hosts a Compute Engine instance with a MySQL database, and Project B hosts an application that needs to connect to the database. The network team set up VPC peering between the two VPCs. The application cannot connect to the database on port 3306. The database instance has a private IP. The network team has verified that firewall rules in both VPCs allow traffic from Project B's subnets to the database IP on port 3306. Ping from the application instance to the database IP succeeds. What should the architect do to resolve the connectivity issue?

Accepted Answer

Configure custom routes export on the VPC peering connection in the database project (Project A).. Since ping succeeds, routing for ICMP is functional, but TCP on port 3306 fails. This indicates that the issue is not with VPC peering route exchange (which includes subnet routes like the database’s private IP). The problem likely lies with the database not listening on the private IP (e.g., bound to localhost) or a host-level firewall. Option A checks for overlapping subnets, which is a prerequisite and already satisfied. Therefore, option C is not the correct fix.

Answer

Ensure that the VPC peering is established and that the subnet ranges do not overlap.

Answer

Configure Cloud NAT in Project B to enable outbound connections.

Answer

Set up a Cloud VPN tunnel between the two projects instead.

Question 10

A global e-commerce platform uses Cloud Spanner in a multi-region configuration across us-central1 (leader) and europe-west1. The application writes all orders to a single table and reads from both regions. During a flash sale, write latency spikes, causing order failures. The team notices that the leader region's CPU utilization is at 95%, while the europe-west1 region is mostly idle. The application uses partitioned DML for batch updates. The development team proposes increasing node count. What should the architect do to reduce write latency while maintaining global read performance?

Accepted Answer

Change the placement configuration to use a dual-region with multiple writable leaders.. Configuring a dual-region with multiple writable leaders distributes write operations across both regions, reducing CPU utilization on the original leader region. This approach improves write latency during high-traffic events like a flash sale while maintaining global read performance from both regions. Scaling by adding nodes (as proposed) is also valid, but among the given choices, changing the placement configuration directly addresses the single-leader bottleneck.

Answer

Implement manual sharding by splitting the large table into multiple smaller tables across instances.

Answer

Use interleaved tables to reduce query latency for reads.

Answer

Create a new node pool with a machine type that has at least 16 vCPUs to handle the write-intensive workload.

Question 11

Your company runs a microservices application on Google Kubernetes Engine (GKE). The security team requires that all pod-to-pod traffic within the cluster be encrypted in transit without modifying application code. You need to implement a solution that provides transparent encryption for all pod network traffic. What should you do?

Accepted Answer

Enable GKE network encryption by creating a cluster with the --enable-network-encryption flag, which uses IPsec to encrypt all pod traffic.. GKE network encryption uses IPsec to encrypt all pod-to-pod traffic transparently, without requiring application changes or sidecars. Enabling it at cluster creation ensures that all network traffic between pods is encrypted. Other solutions like service meshes provide encryption only for services within the mesh and require additional configuration, making them less suitable for a cluster-wide requirement.

Answer

Enable Istio on the cluster and configure mutual TLS (mTLS) between all services using PeerAuthentication policies.

Answer

Enable GKE Dataplane V2 and configure network encryption using the --enable-dataplane-v2 flag with encryption settings.

Answer

Configure a service mesh using Anthos Service Mesh and enforce strict mTLS for all services in the mesh.

Question 12

You are designing a multi-tier application on Google Cloud. The web tier runs on managed instance groups, the app tier on Google Kubernetes Engine (GKE), and the database tier on Cloud SQL. You need to ensure that only the app tier can connect to the database, and that the web tier cannot. The app tier and web tier are in different subnets. What should you do?

Accepted Answer

Configure Cloud SQL with a private IP address. Create a firewall rule in the VPC that allows ingress to the Cloud SQL instance from the app tier's subnet on port 3306, and ensure no rule allows ingress from the web tier's subnet. Use network tags on the GKE nodes to apply the rule.. To restrict database access, use Cloud SQL with a private IP so that VPC firewall rules apply. Then create an ingress rule allowing the app tier's subnet to reach the database port, and ensure no ingress rule exists for the web tier. Network tags help identify the source. This provides network-level isolation without exposing the database externally.

Answer

Deploy a Cloud VPN between the web tier subnet and the app tier subnet. Configure the VPN to allow only the app tier to access the database. Use VPC Service Controls to enforce the boundary.

Answer

Use Cloud SQL's authorized networks feature to allow only the app tier's external IP addresses. Configure the web tier to use a different Cloud SQL instance that has no authorized networks.

Answer

Create a firewall rule that allows traffic from the app tier's subnet to the Cloud SQL instance's IP on port 3306, and another rule that denies traffic from the web tier's subnet to the same IP and port. Apply the rules to the Cloud SQL instance's network tags.

Question 13

Your company is migrating an on-premises application to Google Cloud. The application consists of a web front end and a backend API that communicates with a Cloud SQL for MySQL database. You need to ensure that the application is highly available and can survive a zone failure. Which two configurations should you implement? (Choose two.)

Accepted Answer

Deploy the web front end on a regional managed instance group with autoscaling.. To survive a zone failure, the application must have no single point of failure in any one zone. Deploying the web front end in a regional managed instance group ensures that instances run in multiple zones, and configuring Cloud SQL with high availability provides a standby database in another zone. Together, these ensure that both the front end and database remain available if a zone fails.

Answer

Configure Cloud SQL for MySQL with a single zone instance.

Answer

Deploy the backend API on a single Compute Engine instance in one zone.

Answer

Use a global external HTTP(S) load balancer to distribute traffic to the web front end.

Question 14

Your organization is deploying a multi-tier application on Google Cloud. The application consists of a web frontend running on managed instance groups, a backend running on GKE, and a Cloud SQL for MySQL database. You need to ensure that the application can scale automatically based on load and that the database can handle increased read traffic. You also want to minimize operational overhead. Which two actions should you take? (Choose two.)

Accepted Answer

Set up a Cloud SQL read replica and configure the application to direct read queries to the replica.. Autoscaling the managed instance groups based on CPU utilization ensures the web tier scales with demand, and adding a Cloud SQL read replica with application routing of read queries scales database reads. Both actions reduce operational overhead by leveraging managed services. Cluster autoscaler and high availability do not directly address the stated scaling requirements for the frontend and database reads.

Answer

Configure Cloud SQL high availability by enabling a failover replica.

Answer

Enable GKE cluster autoscaler to automatically adjust the number of nodes based on pod resource requests.

Answer

Use Cloud CDN to cache static content from the web frontend.

Question 15

Your company is migrating an on-premises application to Google Cloud. The application requires a shared file system that can be mounted by multiple Compute Engine instances across different zones. The file system must provide high throughput and be POSIX-compliant. You are evaluating Cloud Filestore and other options. Which TWO statements are correct regarding the use of Cloud Filestore for this scenario? (Choose two.)

Accepted Answer

Cloud Filestore supports the NFSv3 protocol and provides a POSIX-compliant file system that can be mounted by multiple clients simultaneously.. Cloud Filestore is a managed NFSv3 file server that supports simultaneous mounts from multiple Compute Engine instances, making it suitable for shared POSIX-compliant storage. Its performance tiers allow scaling throughput and IOPS by increasing capacity. It is not restricted to a single zone for access; cross-zone access within the same region is possible. CMEK is not default, and it does not use a global anycast IP.

Answer

Cloud Filestore instances can be encrypted with Customer-Managed Encryption Keys (CMEK) by default, and you can manage key rotation through Cloud KMS.

Answer

Cloud Filestore instances can be mounted by Compute Engine instances in the same VPC network, but only within the same zone as the Filestore instance.

Answer

Cloud Filestore can be mounted by instances in multiple VPC networks simultaneously without additional configuration, as it uses a global anycast IP address.