Google PCA Manage implementation of cloud architecture Practice Test 4 — 15 Questions

Question 1

An organization is implementing a Hub-and-Spoke network topology with multiple VPCs. Which Google Cloud product is designed for centralized connectivity and policy enforcement?

Accepted Answer

Shared VPC. Shared VPC (D) is the correct answer because it allows an organization to centrally manage connectivity and enforce network policies across multiple VPCs from a single host project. By designating a host project and attaching service projects, Shared VPC enables centralized control over firewall rules, routes, and IAM policies, which is essential for a hub-and-spoke topology where the host VPC acts as the hub and service VPCs as spokes.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Network Connectivity Center

Question 2

A company uses Cloud Bigtable for time-series data. They experience high latency and uneven load distribution across nodes. What is the most likely cause?

Accepted Answer

The table has a single row key pattern that causes hot spotting. Cloud Bigtable partitions data by row key range and distributes tablets across nodes. A single row key pattern (e.g., monotonically increasing timestamps) causes all writes to target the same tablet, creating a hot spot. This leads to uneven load distribution and high latency because one node is overwhelmed while others remain idle.

Answer

The data is stored in a single column family

Answer

The app is using strong reads instead of eventual consistency

Answer

The cluster has too many nodes

Question 3

A developer needs to secure secrets (API keys, passwords) used in a Cloud Function. What is the recommended approach?

Accepted Answer

Use Secret Manager. Secret Manager is the recommended approach for securing sensitive data like API keys and passwords in Cloud Functions because it provides encrypted storage, fine-grained access control via IAM, and automatic rotation. Unlike environment variables, which are visible in the Cloud Console and logs, Secret Manager ensures secrets are never exposed in plaintext and are injected securely at runtime.

Answer

Store secrets in environment variables

Answer

Store in Cloud Storage and download at runtime

Answer

Hard-code in the function code

Question 4

An organization wants to enforce that all Compute Engine VMs are created with specific disk encryption keys. Which policy mechanism should they use?

Accepted Answer

Organization policies with constraints/compute.restrictDiskEncryptionKeyTypes. Option A is correct because the Organization Policy constraint `constraints/compute.restrictDiskEncryptionKeyTypes` allows administrators to enforce that all Compute Engine VMs must use specific disk encryption key types (e.g., CMEK or CSEK). This policy is evaluated at resource creation time and blocks any VM that does not comply with the allowed key types, providing a preventive control rather than a reactive one.

Answer

IAM roles with compute.diskEncryptionKey permissions

Answer

VPC Service Controls

Answer

Cloud Scheduler to check compliance

Question 5

A company is designing a highly available architecture for a stateful application on Compute Engine. They need to protect against zonal failures. Which THREE steps should they take?

Accepted Answer

Use a global load balancer with health checks. To protect against zonal failures: use a managed instance group across multiple zones (A) to distribute instances; use regional persistent disks (B) that replicate data across zones; and use a global load balancer with health checks (C) to direct traffic to healthy instances. Storing session state in memory (D) is not durable. Using a single zone instance group (E) does not provide HA.

Answer

Store session state in memory

Answer

Use a single zone instance group

Question 6

An organization wants to monitor network traffic between VMs in a VPC for troubleshooting. Which TWO services can provide this?

Accepted Answer

Packet Mirroring (Network Intelligence Center). Packet Mirroring (Network Intelligence Center) is correct because it clones the actual packet contents (headers and payload) from VM instances and forwards them to a collector for deep packet inspection, enabling detailed troubleshooting of network traffic between VMs in a VPC. This service captures full packet data, including application-layer information, which is essential for diagnosing issues like packet loss, latency, or protocol errors.

Answer

Cloud Audit Logs

Answer

Cloud Monitoring

Answer

Cloud Logging

Question 7

What are two best practices for designing a scalable Kubernetes architecture on GKE?

Accepted Answer

Enable horizontal pod autoscaling. Option C is correct because Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU/memory utilization or custom metrics, which is essential for handling variable workloads in a scalable Kubernetes architecture on GKE. HPA works by querying the Metrics Server and adjusting the `replicas` field in the Deployment or StatefulSet, ensuring efficient resource usage without manual intervention.

Answer

Use StatefulSets for stateless applications

Answer

Disable Cluster Autoscaler

Answer

Use a single zone cluster

Question 8

A startup is migrating a monolithic application to Google Cloud. They want to minimize operational overhead and auto-scale based on HTTP request load. Which compute solution should they choose?

Accepted Answer

Cloud Run. Cloud Run is the best choice because it is a fully managed serverless platform that automatically scales from zero based on HTTP request load, minimizing operational overhead. It abstracts away infrastructure management, supports containerized applications, and charges only for resources used during request processing, aligning perfectly with the requirement to auto-scale based on HTTP traffic.

Answer

Compute Engine managed instance groups with autoscaling

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Functions

Question 9

A financial services company runs a mission-critical database on Compute Engine with local SSDs. They need to ensure data durability in case of an instance failure while maintaining low latency. What should they do?

Accepted Answer

Configure a regional persistent disk with synchronous replication and attach it to the instance. Regional persistent disks (PD) provide synchronous replication of data between two zones in the same region, ensuring data durability even if the entire zone fails. By attaching a regional PD to a Compute Engine instance, you maintain low latency (since the disk is network-attached but still within the same region) while achieving the required durability. Local SSDs, while offering very low latency, are ephemeral and lose data on instance failure, so they are not suitable for mission-critical durability requirements.

Answer

Use a managed instance group with autohealing and store data on a persistent disk

Answer

Set up a read replica in another zone using database-native replication

Answer

Take regular snapshots of the local SSDs to Cloud Storage

Question 10

A global e-commerce platform uses Spanner for its transactional database. They observe that some transactions are aborted with 'ABORTED' status due to contention. The application retries immediately, but throughput degrades. What design change should they implement to reduce contention?

Accepted Answer

Redesign the schema to use a separate table for frequently updated rows and batch updates using a single transaction. Option A is correct because Spanner contention arises when multiple transactions try to update the same row concurrently, causing aborts. By redesigning the schema to use a separate table for frequently updated rows and batching updates into a single transaction, you reduce the number of overlapping locks on hot rows. This minimizes lock conflicts and aborts, improving throughput without changing Spanner's underlying TrueTime-based concurrency control.

Answer

Increase the number of nodes in the Spanner instance

Answer

Use client-side retry with exponential backoff and jitter

Answer

Change the transaction isolation level to READ UNCOMMITTED

Question 11

A company wants to store customer transaction logs for 7 years for compliance. The logs are accessed rarely but must be retrievable within 24 hours. Which storage option is most cost-effective?

Accepted Answer

Cloud Storage Archive class. Cloud Storage Archive class is the most cost-effective option for data that is accessed rarely and requires retrieval within 24 hours. Archive class offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of 12 hours, which comfortably meets the 24-hour requirement. This makes it ideal for long-term compliance retention of transaction logs that are infrequently accessed.

Answer

Cloud Storage Nearline class

Answer

Cloud Storage Coldline class

Answer

Cloud Storage Standard class

Question 12

A healthcare SaaS provider runs workloads in Google Cloud and needs to comply with HIPAA. They use Cloud SQL for PostgreSQL and want to encrypt data at rest with customer-managed encryption keys (CMEK). Which steps must they take?

Accepted Answer

Create a Cloud KMS key ring and key, then specify the key when creating the Cloud SQL instance. Option A is correct because Cloud SQL for PostgreSQL supports CMEK only at instance creation time. You must first create a Cloud KMS key ring and key in the same region as the instance, then specify that key when creating the Cloud SQL instance. This ensures that the data at rest is encrypted with a customer-managed key, meeting HIPAA compliance requirements for control over encryption keys.

Answer

Use customer-supplied encryption keys (CSEK) by uploading your own key material

Answer

Enable CMEK in the Cloud SQL instance's settings after creation

Answer

Create a Cloud HSM key and grant the Cloud SQL service account access to it

Question 13

A media streaming company uses Google Cloud CDN to deliver content. They notice that users in certain regions experience high latency despite CDN caching. The content is dynamic based on user location (e.g., local news). What should they do to improve performance?

Accepted Answer

Deploy Cloud Run services in multiple regions and use a global external HTTPS load balancer with backend services to route requests to the nearest region. Option A is correct because deploying Cloud Run services in multiple regions and using a global external HTTPS load balancer with backend services enables location-based routing via the load balancer's anycast IP and backend service configuration. The load balancer automatically routes user requests to the nearest Cloud Run backend that has capacity, reducing latency for dynamic, location-specific content that cannot be effectively cached by Cloud CDN.

Answer

Use Cloud Functions with a regional HTTP trigger and Cloud CDN to cache the responses

Answer

Use Cloud Armor to route traffic to the nearest point of presence

Answer

Configure Cloud CDN to use cache keys based on user location headers

Question 14

A company wants to deploy a containerized application on Google Cloud and needs persistent storage that can be accessed by multiple pods in a GKE cluster concurrently. Which storage solution should they use?

Accepted Answer

Filestore. Filestore is the correct choice because it provides a managed NFS file server that supports the ReadWriteMany (RWX) access mode, allowing multiple pods in a GKE cluster to concurrently read from and write to the same persistent storage volume. This is essential for workloads like content management systems or shared data processing that require simultaneous access from multiple pods.

Answer

Persistent Disk with ReadWriteMany access mode

Answer

Cloud Storage via Storage FUSE

Answer

Compute Engine persistent disk attached to each node

Question 15

An organization uses Cloud Deployment Manager to manage infrastructure as code. They need to ensure that changes to production resources are reviewed and approved before deployment. What should they do?

Accepted Answer

Integrate Cloud Deployment Manager with Cloud Build and add a manual approval step in the Cloud Build pipeline. Cloud Deployment Manager does not have built-in approval workflows. Using Cloud Build with a manual approval step in a CI/CD pipeline allows review before deployment. Terraform with Cloud Source Repositories doesn't enforce approval. Cloud Run for Anthos is irrelevant. Cloud Scheduler doesn't add review.

Answer

Use Cloud Scheduler to run deployment configs and review logs after deployment

Answer

Create a Cloud Deployment Manager preview deployment and manually approve it

Answer

Use Cloud Build with a trigger on a branch that requires pull request approval before merging