Google PCA Manage implementation of cloud architecture Practice Test 6 — 15 Questions

Question 1

A startup is migrating a monolithic application to Google Cloud. They want to minimize operational overhead and auto-scale based on HTTP request load. Which compute solution should they choose?

Accepted Answer

Cloud Run. Cloud Run is the best choice because it is a fully managed serverless platform that automatically scales from zero based on HTTP request load, minimizing operational overhead. It abstracts away infrastructure management, supports containerized applications, and charges only for resources used during request processing, aligning perfectly with the requirement to auto-scale based on HTTP traffic.

Answer

Compute Engine managed instance groups with autoscaling

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Functions

Question 2

A company wants to store customer transaction logs for 7 years for compliance. The logs are accessed rarely but must be retrievable within 24 hours. Which storage option is most cost-effective?

Accepted Answer

Cloud Storage Archive class. Cloud Storage Archive class is the most cost-effective option for data that is accessed rarely and requires retrieval within 24 hours. Archive class offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of 12 hours, which comfortably meets the 24-hour requirement. This makes it ideal for long-term compliance retention of transaction logs that are infrequently accessed.

Answer

Cloud Storage Nearline class

Answer

Cloud Storage Coldline class

Answer

Cloud Storage Standard class

Question 3

A company wants to deploy a containerized application on Google Cloud and needs persistent storage that can be accessed by multiple pods in a GKE cluster concurrently. Which storage solution should they use?

Accepted Answer

Filestore. Filestore is the correct choice because it provides a managed NFS file server that supports the ReadWriteMany (RWX) access mode, allowing multiple pods in a GKE cluster to concurrently read from and write to the same persistent storage volume. This is essential for workloads like content management systems or shared data processing that require simultaneous access from multiple pods.

Answer

Persistent Disk with ReadWriteMany access mode

Answer

Cloud Storage via Storage FUSE

Answer

Compute Engine persistent disk attached to each node

Question 4

An organization uses Cloud Deployment Manager to manage infrastructure as code. They need to ensure that changes to production resources are reviewed and approved before deployment. What should they do?

Accepted Answer

Integrate Cloud Deployment Manager with Cloud Build and add a manual approval step in the Cloud Build pipeline. Integrating Cloud Deployment Manager with Cloud Build allows you to create a CI/CD pipeline that includes a manual approval step. This ensures that changes to production resources are reviewed and approved before the deployment config is applied, meeting the requirement for change control.

Answer

Use Cloud Scheduler to run deployment configs and review logs after deployment

Answer

Create a Cloud Deployment Manager preview deployment and manually approve it

Answer

Use Cloud Build with a trigger on a branch that requires pull request approval before merging

Question 5

Which THREE of the following are recommended practices when designing a highly available architecture on Google Cloud using multiple regions?

Accepted Answer

Use a global external HTTP(S) load balancer with backend services in multiple regions. Option B is correct because a global external HTTP(S) load balancer uses a single anycast IP and automatically routes users to the closest healthy backend service across multiple regions, providing global failover and low-latency access. Option C is correct because Cloud Spanner offers a multi-region configuration with synchronous replication and strong consistency, and cross-region replication for databases ensures data survives a regional outage. Option D is correct because health checks detect unhealthy endpoints and Cloud DNS weighted routing (or failover routing policies) can automatically direct traffic away from a failed region. Option A is not recommended because a single regional managed instance group confines instances to one region, so a regional outage takes down the whole workload. Option E is not recommended because a single Cloud VPN tunnel is a single point of failure; highly available designs require redundant tunnels or Cloud Interconnect with multiple paths.

Answer

Deploy Compute Engine instances in a single regional managed instance group

Answer

Use a single Cloud VPN tunnel for connectivity between regions

Question 6

Which TWO of the following are benefits of using a VPC Service Controls perimeter?

Accepted Answer

Prevent data exfiltration from managed services like BigQuery and Cloud Storage. VPC Service Controls perimeters are designed to mitigate data exfiltration risks for managed services such as BigQuery, Cloud Storage, and other Google Cloud APIs, so option A is correct because the perimeter restricts data movement across its boundary even when credentials are valid. Option E is also correct because a perimeter defines an authorized boundary (based on VPC networks, projects, and access levels) from which managed services can be reached, effectively allowing access only from authorized VPC networks. Option B is wrong because VPC Service Controls is not a network firewall for Compute Engine instances; that role belongs to VPC firewall rules and hierarchical firewall policies. Option C is wrong because encryption in transit between on-premises and Google Cloud is handled by mechanisms such as Cloud VPN, Cloud Interconnect with MACsec, or application-layer TLS, not by VPC Service Controls. Option D is wrong because VPC Service Controls complements rather than replaces IAM; IAM still governs identities and permissions, while the perimeter adds an independent context-aware boundary.

Answer

Act as a network firewall for Compute Engine instances

Answer

Provide encryption of data in transit between on-premises and Google Cloud

Answer

Replace Identity and Access Management (IAM) for service access control

Question 7

A developer needs to deploy a stateful application that requires persistent storage across pod restarts in Google Kubernetes Engine. Which resource should they use?

Accepted Answer

PersistentVolumeClaim. A PersistentVolumeClaim (PVC) is the correct resource because it allows a pod to request persistent storage that survives pod restarts. In GKE, a PVC binds to a PersistentVolume (PV), which can be backed by Compute Engine persistent disks, ensuring data remains available even if the pod is rescheduled or restarted.

Answer

ConfigMap

Answer

EmptyDir

Answer

Secret

Question 8

A company stores sensitive data in Cloud Storage and wants to enforce encryption at rest using customer-managed keys. Which Google Cloud service should they use to manage the keys?

Accepted Answer

Cloud KMS. Cloud KMS (Key Management Service) is the correct choice because it is the native Google Cloud service for managing cryptographic keys, including customer-managed encryption keys (CMEK). It allows you to create, rotate, and control access to keys used to encrypt data at rest in Cloud Storage, and it integrates directly with Cloud Storage's CMEK feature. Cloud HSM is a hardware-backed key management option but is built on top of Cloud KMS, not a separate service for key management.

Answer

Cloud HSM

Answer

Secret Manager

Answer

IAM

Question 9

A company is using Cloud Load Balancing with backend services across multiple regions. They notice that traffic is not being evenly distributed and some backends are overloaded. Which configuration should they check?

Accepted Answer

Session affinity settings. Session affinity (sticky sessions) directs all requests from a single client to the same backend instance. If enabled, this can cause uneven load distribution because certain clients may generate disproportionately more traffic, overloading their pinned backends while others remain underutilized. Disabling or properly configuring session affinity allows the load balancer to distribute requests based on its default algorithm (e.g., round-robin or least-connections), improving balance across backends.

Answer

Firewall rules

Answer

Cloud CDN caching

Answer

Health check frequency

Question 10

A large enterprise is migrating their on-premises data center to Google Cloud. They have hundreds of VMs and need to minimize network latency between on-prem and cloud during migration. They have high bandwidth requirements. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, high-bandwidth, low-latency connection between on-premises data centers and Google Cloud, bypassing the public internet. This is ideal for large-scale migrations with hundreds of VMs where minimizing latency and ensuring consistent throughput is critical.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Peering with Google

Question 11

A company is deploying a web application on Compute Engine. They want to automatically scale the number of instances based on CPU utilization. Which two components are required to set up autoscaling? (Choose two.)

Accepted Answer

Instance template. Option C (Instance template) is correct because a managed instance group requires an instance template to define the machine type, boot disk image, network, and other configuration used when automatically creating new VM instances during scaling. Option D (Managed instance group) is correct because autoscaling in Compute Engine operates on a managed instance group (MIG), where the autoscaler adds or removes instances based on the specified CPU utilization target. Cloud Functions (A) is a serverless event-driven compute service and plays no role in Compute Engine autoscaling. Cloud Load Balancing (B) is commonly used to distribute traffic to the instances but is not a required component to configure the autoscaling policy itself. Cloud Monitoring (E) can surface metrics and alerts, but the autoscaler uses the MIG's built-in CPU utilization signal and does not require a separate Monitoring configuration.

Answer

Cloud Functions

Answer

Cloud Load Balancing

Answer

Cloud Monitoring

Question 12

A company uses preemptible VMs for batch processing. They notice that during peak hours, many instances are terminated before finishing their tasks. The operations team observes the output shown in the exhibit. Which action would best improve job completion rates without significantly increasing costs?

Accepted Answer

Use instance groups with a mix of preemptible and regular VMs. Using a mixed instance group with both preemptible and regular VMs allows the batch processing job to continue on regular VMs when preemptible VMs are terminated during peak hours. This balances cost and reliability: preemptible VMs handle most of the workload at low cost, while regular VMs act as a fallback to ensure job completion without the full expense of switching entirely to regular VMs.

Answer

Increase the number of instances to compensate for terminations

Answer

Use sole-tenant nodes for these instances

Answer

Use committed use discounts for 1 year

Answer

Switch to regular VMs for critical jobs

Question 13

A company has a Cloud Run service that processes images uploaded by users. The service reads the images from a Cloud Storage bucket and writes processed images to another bucket. The team recently updated the service to use a custom service account named 'image-processor-sa' with minimal permissions. After the update, the service fails with permission errors when trying to read from the source bucket. The team verified that the service account has the Storage Object Viewer role on the source bucket and Storage Object Creator role on the destination bucket. What should the architect do to resolve the issue?

Accepted Answer

Ensure the Cloud Run service uses the correct service account by redeploying with the --service-account flag set to 'image-processor-sa@project-id.iam.gserviceaccount.com'.. The error occurs because the Cloud Run service is not using the custom service account 'image-processor-sa' despite it being created and granted permissions. By default, Cloud Run uses the Compute Engine default service account unless explicitly overridden. Redeploying with the --service-account flag attaches the correct identity to the Cloud Run revision, allowing it to authenticate with Cloud Storage using the minimal permissions already assigned.

Answer

Grant the service account the Cloud Run Invoker role on the Cloud Run service.

Answer

Assign the Storage Admin role to the service account.

Answer

Enable the Cloud Storage API for the project.

Question 14

A startup is setting up a CI/CD pipeline for their web application using Cloud Build and Cloud Deploy. They have configured a Cloud Build trigger that executes on pushes to the main branch of a Cloud Source Repositories repository. The trigger runs a build step that builds a Docker image and pushes it to Artifact Registry, then creates a release using Cloud Deploy. The pipeline fails with an error message indicating that the Cloud Build service account does not have permission to create releases. What should the architect do to resolve the issue?

Accepted Answer

Add the Cloud Deploy Developer IAM role to the Cloud Build service account.. The Cloud Build service account (typically the Compute Engine default service account or a custom service account) needs the Cloud Deploy Developer IAM role (roles/clouddeploy.developer) to create releases in Cloud Deploy. This role grants the necessary permissions, such as clouddeploy.releases.create, which are required for the Cloud Build trigger to successfully create a release after building and pushing the Docker image. Without this role, the pipeline fails with a permission error, making option A the correct resolution.

Answer

Verify that the cloudbuild.yaml file contains the correct steps.

Answer

Enable the Cloud Deploy API for the project.

Answer

Grant the Cloud Build service account the Cloud Run Admin role.

Question 15

A financial services company uses VPC Service Controls to protect their project containing BigQuery datasets and Cloud Storage buckets. They have a perimeter that includes the BigQuery service. Users report that they cannot export data from BigQuery to Cloud Storage using the web console. The export job fails with an access denied error. The team needs to allow exports while maintaining data exfiltration prevention. The users have the necessary IAM permissions (BigQuery Data Editor, Storage Object Admin) on the appropriate resources. What should the architect do?

Accepted Answer

Add Cloud Storage to the same VPC Service Controls perimeter.. VPC Service Controls perimeters enforce data exfiltration prevention by default, blocking egress from protected services (like BigQuery) to unprotected services (like Cloud Storage). Adding Cloud Storage to the same perimeter allows BigQuery to export data to Cloud Storage while still preventing data from leaving the perimeter. The users already have the necessary IAM roles (BigQuery Data Editor and Storage Object Admin), so the issue is solely the perimeter boundary, not permissions.

Answer

Remove BigQuery from the VPC Service Controls perimeter.

Answer

Create an access level that permits exports during business hours.

Answer

Grant the users the Storage Object Admin role at the bucket level.