Google PCA Manage implementation of cloud architecture Practice Test 4 — 15 Questions

Question 1

A developer is using Cloud Build to automate deployments. The build fails with an error: 'Permission 'iam.serviceAccounts.actAs' denied.' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Service Account User role on the service account used in the build steps. The error 'Permission iam.serviceAccounts.actAs denied' occurs when a Cloud Build build step tries to impersonate a service account (e.g., to deploy resources) but the Cloud Build service account lacks the Service Account User role on that target service account. Option D correctly identifies that the Cloud Build service account does not have the `roles/iam.serviceAccountUser` role on the service account used in the build steps, which is required to delegate access.

Answer

The developer does not have iam.serviceAccounts.actAs permission on the project

Answer

The build configuration is missing a required step

Answer

The Cloud Build service account is not enabled

Question 2

A company wants to store backup data that is accessed rarely but must be available for retrieval within minutes. Which Cloud Storage class is appropriate?

Accepted Answer

Nearline. Nearline storage is designed for data accessed less than once a month but requires retrieval within minutes, making it ideal for backup data that needs quick availability. It offers lower cost than Standard storage while still supporting sub-minute retrieval times, aligning with the scenario's access and latency requirements.

Answer

Standard

Answer

Coldline

Answer

Archive

Question 3

An organization is implementing a Hub-and-Spoke network topology with multiple VPCs. Which Google Cloud product is designed for centralized connectivity and policy enforcement?

Accepted Answer

Shared VPC. Shared VPC (D) is the correct answer because it allows an organization to centrally manage connectivity and enforce network policies across multiple VPCs from a single host project. By designating a host project and attaching service projects, Shared VPC enables centralized control over firewall rules, routes, and IAM policies, which is essential for a hub-and-spoke topology where the host VPC acts as the hub and service VPCs as spokes.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Network Connectivity Center

Question 4

A company uses Cloud Bigtable for time-series data. They experience high latency and uneven load distribution across nodes. What is the most likely cause?

Accepted Answer

The table has a single row key pattern that causes hot spotting. Cloud Bigtable partitions data by row key range and distributes tablets across nodes. A single row key pattern (e.g., monotonically increasing timestamps) causes all writes to target the same tablet, creating a hot spot. This leads to uneven load distribution and high latency because one node is overwhelmed while others remain idle.

Answer

The data is stored in a single column family

Answer

The app is using strong reads instead of eventual consistency

Answer

The cluster has too many nodes

Question 5

A developer needs to secure secrets (API keys, passwords) used in a Cloud Function. What is the recommended approach?

Accepted Answer

Use Secret Manager. Secret Manager is the recommended approach for securing sensitive data like API keys and passwords in Cloud Functions because it provides encrypted storage, fine-grained access control via IAM, and automatic rotation. Unlike environment variables, which are visible in the Cloud Console and logs, Secret Manager ensures secrets are never exposed in plaintext and are injected securely at runtime.

Answer

Store secrets in environment variables

Answer

Store in Cloud Storage and download at runtime

Answer

Hard-code in the function code

Question 6

An organization wants to enforce that all Compute Engine VMs are created with specific disk encryption keys. Which policy mechanism should they use?

Accepted Answer

Organization policies with constraints/compute.restrictDiskEncryptionKeyTypes. The Organization Policy constraint `constraints/compute.restrictDiskEncryptionKeyTypes` allows administrators to enforce that all Compute Engine VMs must use specific disk encryption key types (e.g., CMEK or CSEK). This policy is evaluated at resource creation time and blocks any VM that does not comply with the allowed key types, providing a preventive control rather than a reactive one.

Answer

IAM roles with compute.diskEncryptionKey permissions

Answer

VPC Service Controls

Answer

Cloud Scheduler to check compliance

Question 7

A company is designing a highly available architecture for a stateful application on Compute Engine. They need to protect against zonal failures. Which THREE steps should they take?

Accepted Answer

Use a global load balancer with health checks. A global load balancer with health checks distributes traffic across healthy instances in multiple zones, automatically routing requests away from failed zones. This ensures that if a zone fails, traffic is redirected to instances in other zones, maintaining availability for the stateful application.

Answer

Store session state in memory

Answer

Use a single zone instance group

Question 8

An organization wants to monitor network traffic between VMs in a VPC for troubleshooting. Which TWO services can provide this?

Accepted Answer

Packet Mirroring (Network Intelligence Center). Packet Mirroring (Network Intelligence Center) clones actual packet contents (headers and payload) from VM instances for deep packet inspection, enabling detailed troubleshooting. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet count) flowing to and from VMs, providing visibility into network traffic patterns and bottlenecks. Both services are useful for monitoring network traffic between VMs in a VPC, with Packet Mirroring offering full packet capture and VPC Flow Logs providing metadata-level logging.

Answer

Cloud Audit Logs

Answer

Cloud Monitoring

Answer

Cloud Logging

Question 9

What are two best practices for designing a scalable Kubernetes architecture on GKE?

Accepted Answer

Enable horizontal pod autoscaling. Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU/memory utilization or custom metrics, which is essential for handling variable workloads in a scalable Kubernetes architecture on GKE. HPA works by querying the Metrics Server and adjusting the `replicas` field in the Deployment or StatefulSet, ensuring efficient resource usage without manual intervention.

Answer

Use StatefulSets for stateless applications

Answer

Disable Cluster Autoscaler

Answer

Use a single zone cluster

Question 10

A startup is migrating a monolithic application to Google Cloud. They want to minimize operational overhead and auto-scale based on HTTP request load. Which compute solution should they choose?

Accepted Answer

Cloud Run. Cloud Run is the best choice because it is a fully managed serverless platform that automatically scales from zero based on HTTP request load, minimizing operational overhead. It abstracts away infrastructure management, supports containerized applications, and charges only for resources used during request processing, aligning perfectly with the requirement to auto-scale based on HTTP traffic.

Answer

Compute Engine managed instance groups with autoscaling

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Functions

Question 11

A financial services company runs a mission-critical database on Compute Engine with local SSDs. They need to ensure data durability in case of an instance failure while maintaining low latency. What should they do?

Accepted Answer

Configure a regional persistent disk with synchronous replication and attach it to the instance. Regional persistent disks (PD) provide synchronous replication of data between two zones in the same region, ensuring data durability even if the entire zone fails. By attaching a regional PD to a Compute Engine instance, you maintain low latency (since the disk is network-attached but still within the same region) while achieving the required durability. Local SSDs, while offering very low latency, are ephemeral and lose data on instance failure, so they are not suitable for mission-critical durability requirements.

Answer

Use a managed instance group with autohealing and store data on a persistent disk

Answer

Set up a read replica in another zone using database-native replication

Answer

Take regular snapshots of the local SSDs to Cloud Storage

Question 12

A global e-commerce platform uses Spanner for its transactional database. They observe that some transactions are aborted with 'ABORTED' status due to contention. The application retries immediately, but throughput degrades. What design change should they implement to reduce contention?

Accepted Answer

Redesign the schema to use a separate table for frequently updated rows and batch updates using a single transaction. Spanner contention arises when multiple transactions try to update the same row concurrently, causing aborts. By redesigning the schema to use a separate table for frequently updated rows and batching updates into a single transaction, you reduce the number of overlapping locks on hot rows. This minimizes lock conflicts and aborts, improving throughput without changing Spanner's underlying TrueTime-based concurrency control.

Answer

Increase the number of nodes in the Spanner instance

Answer

Use client-side retry with exponential backoff and jitter

Answer

Change the transaction isolation level to READ UNCOMMITTED

Question 13

A company wants to store customer transaction logs for 7 years for compliance. The logs are accessed rarely but must be retrievable within 24 hours. Which storage option is most cost-effective?

Accepted Answer

Cloud Storage Archive class. Cloud Storage Archive class is the most cost-effective option for data that is accessed rarely and requires retrieval within 24 hours. Archive class offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of 12 hours, which comfortably meets the 24-hour requirement. This makes it ideal for long-term compliance retention of transaction logs that are infrequently accessed.

Answer

Cloud Storage Nearline class

Answer

Cloud Storage Coldline class

Answer

Cloud Storage Standard class

Question 14

A healthcare SaaS provider runs workloads in Google Cloud and needs to comply with HIPAA. They use Cloud SQL for PostgreSQL and want to encrypt data at rest with customer-managed encryption keys (CMEK). Which steps must they take?

Accepted Answer

Create a Cloud KMS key ring and key, then specify the key when creating the Cloud SQL instance. Cloud SQL for PostgreSQL supports CMEK only at instance creation time. You must first create a Cloud KMS key ring and key in the same region as the instance, then specify that key when creating the Cloud SQL instance. This ensures that the data at rest is encrypted with a customer-managed key, meeting HIPAA compliance requirements for control over encryption keys.

Answer

Use customer-supplied encryption keys (CSEK) by uploading your own key material

Answer

Enable CMEK in the Cloud SQL instance's settings after creation

Answer

Create a Cloud HSM key and grant the Cloud SQL service account access to it

Question 15

A media streaming company uses Google Cloud CDN to deliver content. They notice that users in certain regions experience high latency despite CDN caching. The content is dynamic based on user location (e.g., local news). What should they do to improve performance?

Accepted Answer

Deploy Cloud Run services in multiple regions and use a global external HTTPS load balancer with backend services to route requests to the nearest region. Deploying Cloud Run services in multiple regions and using a global external HTTPS load balancer with backend services enables location-based routing via the load balancer's anycast IP and backend service configuration. The load balancer automatically routes user requests to the nearest Cloud Run backend that has capacity, reducing latency for dynamic, location-specific content that cannot be effectively cached by Cloud CDN.

Answer

Use Cloud Functions with a regional HTTP trigger and Cloud CDN to cache the responses

Answer

Use Cloud Armor to route traffic to the nearest point of presence

Answer

Configure Cloud CDN to use cache keys based on user location headers